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TITLE OF THE INVENTION 

METHOD AND APPARATUS FOR RISK MANAGEMENT 

BACKGROUND OF THE INVENTION 

Field of the Invention 

The invention is related to the management of risk in general and more particularly to 
an apparatus and method of managing risks associated with terrorism. 
Related Art 

Risk can be defined as probability * vulnerability. Probability is the probability that 
an undesirable event will occur. Vulnerability is susceptibility to the event multiplied by the 
consequences associated with that event. Managing risk involves the process of determining 
the risk and taking steps to decrease the risk by decreasing the probability or vulnerability, or 
both. Managing risk is an important task faced by people in many different situations. 
Insurance companies and financial planners manage risk to capital when deciding when to 
insure and what stocks on bonds to include in a portfolio. Homeowners manage risk when 
deciding whether to purchase a burglar alarm system. One particularly important form of risk 
management is terrorism prevention. 

Terrorism is a world-wide problem. Unfortunately, many in the United States 
associate terrorism with certain Arabian and/or Islamic nations and view the threat of 
terrorism firom this limited framework. However, as recent events such as the Oklahoma City 
bombing have demonstrated, terrorism is not limited to any particular nation, religion, 
political system, or ideology. Today, the problem has become far more complex and is 
rapidly changing. 



One problem faced by those with responsibihty for assessing the threat of terrorism 
and its prevention is the lack of suitable tools to help them perform their tasks. Known tools 
generally fall into one of two categories: a) terrorist attack damage assessors; and b) terrorist 
attack likelihood predictors (i.e., probability calculators). The first type of tool, terrorist 
attack damage assessors (i.e., consequence calculators), are generally computer based. These 
tools attempt to answer the questions like "What will happen if a car carrying a 500 pound 
bomb explodes at the front door of my building?" (Blast model tools) and "What will happen 
if a 50 gallon drum of nerve gas is opened in the parking garage?" ("CBR" - chemical, 
biological and radiological - tools). The tools, which typically employ complex computer 
modeling algorithms such as those found in CAD/CAM programs, have three important 
drawbacks. First, they require detailed information (which can be difficult, time consuming 
and expensive to obtain) to construct the model and are often not flexible enough to handle 
situations in which the detailed data is not available. It is likely that data required to use 
these tools on the Murrah building in Oklahoma City would still not be collected at this point 
due to the time and costs associated with collecting such data. Second, these tools require 
expertise on the part of the user. Third, and perhaps most importantly, programs such as 
these provide no guidance as to the likelihood that the attack will succeed (the accessability), 
the likely location of an attack (e.g., the front or rear of the building, which building, etc., the 
type of weapon (explosive, chemical, biological or radiological) likely to be used, and how to 
prevent or at least minimize the occurrence of the attack in the first place. 

The second type of tool, terrorist attack likelihood predictors, are typified by paper 
and pencil questionnaires provided by government agencies to remote locations. These tools 
attempt to answer the question "How likely am I to be attacked by terrorists?" The form of 
the tool is generally a series of questions such as "Do you have any nuclear material at your 



facility?", "Are you located in an urban, suburban or rural area? And "Are you a military or 
civilian installation?" These questionnaires award a certain number of points based on each 
answer and base the likelihood of terrorist attack on the total number of points. These tools 
also suffer from several serious drawbacks. While they may tell you that an attack is likely, 
5 they provide no guidance as to the nature of the attack and how to prevent it, provide no 
indication as to whether the attack will be successful, and provide no indication of the 
consequence of a successful attack. 

Another problem faced by those charged with preventing terrorism is the lack of 
flexibility in adapting anti-terrorism plans. It has become the practice of many institutions to 
M) formulate an anti-terrorism plan that defines a number of threat levels. These plans are 

typically prepared by outside agencies or consulting firms based on individual knowledge and 
experience. Updating the plans based on changed circumstances requires the individual 
iy security specialists to be recalled, which is expensive and time consuming. Furthermore, the 
H plans may not be appropriate for changing circumstances. By way of example, there may be 
fife great differences between a plan for high threat of terrorist activity on a military installation 
''g that was designed to protect mission-critical assets such as a weapons system and a plan for a 

high threat of terrorist activity on that same military installation when the high-threat 
condition is caused by a visit from a head of state or because of threatened attacks on troops 
rather than the weapons system. Furthermore, the source of the threat may also change its 
2 0 nature. A plan devised to stop a suicide car bomb attack favored by one known terrorist 
group may not be effective for a chemical attack favored by another terrorist group. 

Changes to the plan may also become necessary because the site has expanded, or 
because of changes to the physical surroundings (e.g., new developments have been built in 
close proximity to a site previously surrounded by woods). Plan changes are also 
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necessitated by the frequent changes to AT/FP doctrine, enunciated in sources such as DoD 
2000.16, the Joint Service Integrated VulnerabiHty Assessment (JSIVA) Team standard 
operating procedures, and the J34 Listallation AT/FP Planning Template, due to the evolving 
nature of the threat and lessons learned from previous attacks. 

SUMMARY OF THE INVENTION 

The aforementioned deficiencies have been overcome to a great extent by the present 
invention which provides an integrated risk management tool. The integrated risk 
management tool uses a persistent object database to store information about actors 
(individuals and/or groups), physical surroundings, historical events and other information. 
The risk management tool also includes a decision support system that uses data objects from 
the database and advanced decision theory techniques, such as Bayesian Networks, to infer 
the relative risk of an undesirable event. As part of the relative risk calculation, the tool uses 
a simulation and gaming environment in which artificially intelligent actors interact with the 
environment to determine susceptibility to the imdesired event. Finally, the tool includes an 
open "plug-in" architecture that allows the tool to interface with existing consequence 
calculators. The tool also provides facilities for presenting data in a user-friendly manner as 
well as report generation facilities. 

In preferred embodiments, the invention takes the form of a software program that 
may be run on a personal computer or workstation that allows users to evaluate the risk of a 
terrorist attack at their site, determine their vulnerability to a terrorist attack, assess the 
damage caused by a successful terrorist attack, and select countermeasures to prevent terrorist 
attacks. The program provides the user with importing, drawing and modehng tools to allow 
the user to quickly and easily build a model of the site of interest in both 2 and 3 dimensions. 
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Once the site model is established, simulation is performed to generate information about 
threat scenarios. The simulation can be viewed by the user firom whatever eye-point the user 
chooses. In the simulation, the user selects a weapons system and location for a terrorist 
attack, such as a car bomb at the rear of the building. The simulation constructs and analyzes 
5 possible routes that the terrorist may take to reach the location, taking into consideration the 
site model and all site-specific information such as the existence of roads, car barriers, guard 
stations, hills, etc. The simulation then selects the most probable route and calculates the 
likehhood of success, or accessabihty. The program will allow the user to modify the site 
model to add physical countermeasures (including hardening the target, denying access to the 
Oo target, etc.) and re-run the simulation to determine the effectiveness of the countermeasures. 

The system also provides an artificial intelhgence risk assessment tool to help users 
in manage risk. After the simulations have been run, the risk assessment tool determines 

0 relative risk based on the probabihty of an attack and the vulnerabihty of a site to an attack. 

|=ft Vulnerability is partially based on susceptibility, which in turn is partially based on the 
Qs accessabihty as determined by the simulation described above; and partially based on a 
^ consequence calculation. The use in highly preferred embodiments of physical modeling and 

physics - based accessabihty calculations from the 3D simulation/gaming environment in the 
calculation of relative risk is seen as a particularly advantageous embodiment of the 
invention. In highly preferred embodiments, the risk assessment tool is implemented using a 
2 0 Bayesian influence network. The network is based upon input irom experts in the anti- 
terrorism field. 

The program can also provide damage assessments to the user under the user's control 
- in other words, the consequence calculation portion of the problem can be used 
independently of the risk management process as a whole. Provided with the program are 
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two built-in analysis tools: 1) a first order blast-assessment tool; and 2) a first order 
downwind CBR hazard prediction tool. However, the program is built on a plug-in model. 
That is, the program is designed to interface with industry standard programs so that the 
standard programs will accept input from the invention and return the desired information 
(e.g., blast effects), hi this manner, the program incorporates improvements to these 
programs as they occur without the need to update the program code. The user is allowed to 
specify a weapon system and delivery point, in response to which the system performs the 
damage calculations. 

Preferred embodiments of the invention allow users to produce, view and print 
industry-standard reports as well as custom reports. Planners can develop AT/FP site plans in 
a standard J34 Installation AT/FP Planning Template format. Assessors can log observations 
and produce out-briefs and reports in JSIVA formats. Highly, preferred embodiments of the 
invention produce custom reports in JSIVA formats. More highly, preferred embodiments of 
the invention produce custom reports with detailed data on risk and other items. 

Preferred embodiments of the invention provide a theater-level information 
management system (TIMS 130) that allows senior commanders to view information 
pertaining to muhiple sites under their command. Access to the data is provided through a 
web-accessible browser interface. Preferred embodiments of the present invention also 
include an editing tool that allows modification of the database, the GUI 202, and the output 
of the system. 



BRIEF DESCRIPTION OF THE DRAWINGS 

The foregoing and other features and advantages of the invention will be more readily 
understood with reference to the following drawings in which: 



Figure 1 is a schematic diagram of an automated vulnerability assessment tool 
comprising the VAT, the VAT Editor, and the TIMS, according to one embodiment of the 
present invention. 

Figure 2 is a block diagram of the architecture of the VAT of Figure 1. 

Figure 3 is a view of a screen from a graphical user interface of the VAT according to 
a preferred embodiment of the invention. 

Figure 4 is a symbolic diagram showing contents of the VAT database. 

Figure 5 is a diagram of a risk influence network according to a preferred embodiment 
of the invention. 

Figure 6 is a symbolic diagram showing inputs to the VAT database. 
Figure 7 is an exemplary illustration of a 3D builder screen. 
Figure 8 is a view of screens generated by the GUI. 
Figure 9 is a symbolic view of the plug-in architecture. 
Figure 10 is a symbolic view of the report generation process. 

Figure 1 1 is a schematic view of the interaction of the VAT Editor with other systeni 
components. 

Figure 12 is a block diagram showing connection of the TIMS to remote 
computers/terminals . 

Figure 13 is a user/A VAT interconnection diagram. 
Figure 14 is a review of a Planner Interface screen format. 
Figure 15 is a review of the Risk Assessment Screen. 
Figure 16 is a review of the Risk Summary Table Screen. 
Figure 17 is a review of the "Probability of Attack" Screen. 
Figure 18 is a review of the Risk Detail Screen. 



Figure 19 is a view of the 3D Viewer Screen. 

Figures 20 a-d are screen views illustrating the construction of a 3D object. 

Figure 21 is a block diagram of the Approach Vector Process. 

Figure 22 is a flow diagram of the Risk Management Process. 

Figure 23 is a data flow diagram of Blast and Fragment plug-in data flows. 

Figure 24 is a data flow diagram of Chemical/Biological/Radiological plug-in data 

flows. 

Figure 25 is a schematic diagram of a user created report format. 
Figure 26 is a block diagram of the VAT Data Model. 
Figure 27 is a block diagram of the Meta Data Model. 
Figure 28 is a symbolic diagram of Meta Data Model. 

Figure 29 is a block diagram of the VAT showing dependency relationships. 

Figure 30 is an object association diagram of the database. 

Figure 31 is a table of exemplary screen definitions. 

Figure 32 is a process diagram of the navigational override process. 

Figure 33 is a block diagram of the risk management process. 

Figure 34 is a block diagram showing risk steps and influence network interaction. 

Figures 35a and 35b are susceptibility determination and risk mitigation process 
diagrams, respectively. 

Figure 36 is a diagram showing the relationship between the Influence Network, the 
graphical user interface, and calculations made against the model. 

Figure 37 is a flowchart showing calculation of approach vectors. 

Figure 38 is a block diagram of the Dynamics Module. 

Figure 39 is an object model to relational model conversion map. 



DC:40479.1 



Figure 40 is a class diagram of the Relational Data Model. 

Figure 41 is a flowchart of the 3D Builder Process. 

Figure 42 is a flowchart of the 3D Viewer Process. 

Figure 43 is a block diagram of the 3D Run-time Environment. 

Figure 44 is a block diagram of the VAT Report Generator Subsystem. 

Figure 45 is a schematic diagram of the VAT Plug-in Interface Class Structure. 

Figure 46 is a VAT plug-in state diagram. 

Figure 47 is a review of the TIMS Browser screen. 

Figure 48 is a TIMS Client-Server network diagram. 

Figure 49 is a view of the VAT Editor Modes screens. 

Figure 50 is a view of a user interface screen. 

Figure 5 1 is a node - GUI relational diagram. 

Figure 52 is a package diagram of the VAT Editor. 

Figure 53 is a block diagram of the VAT Editor. 



DETAILED DESCRIPTION 

The present invention will be discussed with reference to preferred embodiments of 
risk management programs. Specific details, such as graphical user interfaces, report formats, 
etc., are set forth in order to provide a thorough understanding of the present invention. The 
preferred embodiments discussed herein should not be understood to limit the invention. 

Although the invention has many uses, it finds particular utility in the terrorism risk 
management arena. Thus, the invention will be discussed in connection with terrorism risk 
management embodiments. However, as will be discussed further below, the invention is 
useful in many fields and is not limited to terrorism risk management embodiments. 



Referring now to Figure 1, an automated vulnerability assessment tool (AVAT) 100 
includes a vulnerability assessment tool (VAT) 200, a theater information management 
system (TIMS) 130, and a VAT Editor 1 50. In preferred embodiments, the tool may be run 
on a personal computer or workstation. Each of these component parts of the AVAT 100 will 
5 be discussed in further detail below. 
The Vulnerability Assessment Tool 

The VAT 200 presents a single interface to the user that accesses a powerful 
underlying architecture. This architecture, shown in Figure 2, is a complex integration of 
modules that are collectively employed to meet the needs of the VAT 200 users. Figure 2 
®0 shows the modules that comprise the VAT 200, the VAT's 200 external interfaces, and the 
it relationships among the components. This complex architecture is better understood by a 

J description of how the system is used. 

40 Users must first interface with the system through a consistent and effective user 

H= interface. The users are not expert computer operators or technical experts, so the mode of 

pl5 communication must be straightforward and easily understood by the layman. The GUI 202 
% provides a web-like interface to the system with easy navigation references, screens that are 
simple and logically organized, and based on a dialog with the user rather than a form-based 
input. The VAT 200 User Interface exemplary screen 300 depicted in Figure 3 illustrates 
what the user interface looks hke as the user enters information. This screen 300 allows 
2 0 direct access at all times to the tools associated with the VAT 200 and provides a structured 
or non-linear progression through the data entry interview, depending on user choice. 

The GUI Engine 210, shown in Figure 2, (the term engine in a software context 
relates to a program that provides a specific capability, but is easily modifiable to support 
various implementations. A "GUI Engine" is simply a program to interact with the user 
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graphically, without requiring scripted user interface screens. A Web browser is a good 
example of a GUI Engine 210 - the browser displays any Hypertext Markup Language 
(HTML) document and its links without them being programmed in the browser) allows user 
interface content to be different for each user while the structure of the interface 202 remains 
the same. This allows the VAT 200 to communicate differently with Planners and 
Professional Assessors, or even among the Services. For example, the Planner interface 204 
contains instruction, examples, and a more verbose dialog to elicit the same information that 
the Professional Assessor may be able to enter through a simple form provided by the 
Professional Assessor interface 206. This allows the user interface 202 to be individualized, 
ensuring that the data is entered and displayed correctly for all users, but efficiently and 
quickly for expert users. 

The GUI Engine 210 receives all of the screens, questions, and display data through 
the Database module 220. The Database module 220 is a relational database that contains all 
of the data used by the VAT 200, whether entered by the user, or calculated by the VAT 200, 
as shown in Figure 4. Driving the GUI 202 from the Database module 220 allows the user 
interface 202 to be dynamic, customizable, and readily updateable without reprogramming 
the user interface 202. 

Although the GUI's 202 first task is to elicit data from the user through the interview 
process, the primary objective of the GUI 202 is to interface with the underlying 
Computational Engine 230 module, shown in Figure 2. The Computational Engme 230 
combines user-entered data, along with data stored in the Database module 220, to calculate 
risk and all of its underlying components. The Computational Engine 230 uses elaborate 
artificial intelhgence and simulation algorithms to analyze and assess the specific targets, 
threats, vulnerabihties, and ultimately, the risks at a user's site. 



The foundation for the Computational Engine 230 is the Influence Network 500 
shown in Figure 5. This network 500 shows all of the nodes 510, 510a that ultimately affect 
the risk of a given threat against a given target. The values for each of the nodes 5 10, 5 10a 
are combined using probabihty and statistics equations that account for the weighting of the 
5 various nodes and the xmcertainty in their values. The network 500 also provides results 

without requiring all of the data to be known. Thus, if the user does not have information for 
the detailed leaf nodes 510a the network 500 can adapt and solve the network 500 based on 
higher level data. 

The VAT 200 architecture allows nodes 510, 510a and sub-nodes (not shown in 
Od Figure 5) of the network 500 to be 'tumed-on' as new information is available. With 
:|: additional information, the confidence in the resuhs should increase. For example, the 

likehhood of an attack may not change as the user adds additional information at the leaf 
IE nodes 5 10a, but we can be more confident in the threat likelihood if it is backed up by 

supporting information. This flexibility allows users to gain quick insights into their risks 

flB and improve on their risk assessment as additional information is available. 

Ill 

*f This network 500 also provides a rigorous, quantitative calculation of risks. The 

network 500 provides an intuitive representation of the factors that the calculation considers. 
It can be read as, 'Leaf node X influences branch node Y, which, in turn, influences node Z'. 
The network 500 is capable of handling influences that camiot be quantitatively described. 

2 0 Thus, if one cannot be sure how much the anniversary of the Branch Davidian incident will 

affect the Probability of Attack (via the "Triggers" Leaf Node 510a), one can still include it in 
the network 500 calculation by simply stating that it may increase the probability. The 
implementation of the network 500 in the Computational Engine 230 also allows for the 
network 500 to be changed or modified without re-programming. Thus, if experts or events 
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indicate that a new factor should be considered, it can be added to the risk network 500 by 
creating a new node object in the Database 220. 

The network 500 provides an integrated representation of the factors that impact the 
specific risks at a site in a manner that can be understood by subject matter experts (to 
vahdate the model) and interpreted by the VAT 200 so that results can be displayed in a 
meaningful maimer to VAT 200 users. The data used by the network 500, as well as the 
network 500 itself, can be modified and upgraded by modifying the database 220 without 
deriving a new equation or reprogramming the VAT 200 artificial intelligence (AI) 
algorithms. 

Many of the inputs to the network 500 can come directly fi-om the GUI 202. Other 
inputs are derived from databases or are provided from intermediate AI, simulation, or model 
calculations. Threat vectors, blast consequences and accessibility of a target are all examples 
of nodes that require additional complex calculations to be conducted. The Computational 
Engine 230 manages all of these calculations. When the calculation involves the physics- 
based interaction of objects (i.e., like driving a truck), the Dynamics module 240 (shown in 
Figure 2) is used to calculate the forces, speed, acceleration, and other relevant physical 
parameters. When the calculation requires detailed modeling of weapons effects the 
Computational Engine 230 accesses external models through the Plug-in Interface 250 and 
uses the results of the model in the consequence nodes of the network 500. Each network 
node is stored in the Database module 220. 

Much of the data required by the Computational Engine 230 is spatial in nature. In 
order to analyze specific terrorist threats, the Computational Engine 230 relies on a 3D 
representation of the user's site. This site is developed using the 3D Builder module 260. 
Like the GUI Engine 210, the 3D Builder module 260 is driven by the Database module 220 



and all of the information entered into the 3D Builder 260 is stored in the Database module 
220. Thus, all of the interfaces in the software are tightly integrated with a single database, as 
shown in Figure 6. 

The 3D Builder 260, a screen shot 700 of which is shown in Figure 7, provides an 
interface for the user to build a 3D representation of his site. The 3D Builder 260 imports 
files from computer aided design (CAD) programs or images and uses them as the outline for 
the site layout. The user can then 'build' virtual representations of the buildings, roads, and 
perimeters of the site and identify population centers, VIPs, and countermeasures. This 
virtual representation of the site is stored in the Database module 220 and is used by the 
Computational Engine 230 to compute threat vectors and the accessibihty of assets and by the 
Analytic Models to calculate weapon effects against targets. 

The GUI 202 must also display complex risk, spatial, temporal, cost, and probabilistic 
data to the user in a useful and effective manner. Because the terrorist threat is often so 
vague and multi-dimensional, the information display must present simplified representations 
of the information and allow the user to interact with the information to see how the data is 
inter-related — what kinds of assets are most susceptible to a certain threat, which threats 
bear the highest consequences, and so on. Information from the risk influence network 500 
and information in the Database module 220 can be interpreted and displayed in many 
combinations and representations. The GUI 202 provides sortable tables, text interpretations 
of data, 3D animations of scenarios, and graphs like the screens 801, 802, 803 shown in 
Figure 8. The GUI 202 provides web-like capability to drill-down into any high level 
information presented by the GUI 202. For example, if the probability of attack for a given 
threat is described in the GUI 202 as 'high', the user will be able to chck on 'high' and drill- 
down to the nodes that caused the value to be high {e.g.. Organization X is active in your 
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area, they have Y weapon capabilities, and Z holy day is a trigger for this threat). 

Understanding risk and the inter-relationships among threat, critical assets, and 
vulnerabilities is essential to developing an AT/FP plan. The Computational Engine 230 
interprets threat data and recommends countermeasures to the user that should be used to 
5 reduce the threat or the consequences of an attack. These countermeasures are not limited to 
hardening of assets (blast wails, FRF, etc.) but include countermeasures to: 

■ Deter the threat from acting, 

■ Deny access to the target, 

■ Detect the threat or event, 

10 ■ Mitigate the consequences of an event, 

■ Interdict the threat, and 

■ Respond to the event. 

^ The Database module 220 retains the relationships among these coimtermeasures and 

f_ I procedures and the threats that they counter to allow the user to develop a defensive posture. 

The 3D Builder 260 allows the user to specifically place countermeasures and optimize their 
g~ placement to be most effective against the threat. 

fd The VAT 200 allows the user to consider costs when employing countermeasures to 

IM manage risk. The VAT 200 does not provide a detailed cost modeling or cost benefit analysis 

^ capability; however, for classes of countermeasures the user may select, the VAT Database 

2 0 220 is populated with 'initial cost' and 'recurring cost' parameters. The values for these 

parameters are defined as none, low, moderate, or high. The database also contains fields for 
the user to enter dollar costs for specific countermeasures, if desired. These costs can be 
printed in custom reports or viewed in risk summary tables to sort and rank risk mitigation 
strategies by cost. 

2 5 Much of the risk data presented to the user is generated by the Computational Engine 

230. However, when considering risk, one of the most important considerations is the 
consequence of a specific threat against a specific target. The resuhs of a threat-target pair 
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must be analyzed to determine the casualties and damage that would result from the event so 
that this data can be used in the risk network 500. Rather than developing a simple routine or 
a new weapons model, the VAT 200 uses existing blast and nuclear, chemical, biological, and 
radiological (NCBR) models to calculate the consequences used by the Computational 
5 Engine 230. In preferred embodiments, six models will be included with the VAT 200: 

■ AT Planner from U.S. Army Corps of Engineers Waterways 
Experiment Station 

■ FP Tool from Naval Surface Warfare Center, Dahlgren, Virginia 

■ Blast/FXTM from TRW, Inc. 

10 ■ Blast Card (Look-up table) from TSWG 

■ HP AC from Defense Threat Reduction Agency (DTRA) 

■ CBR Card (Look-up table) from Titan Corporation 

O The plug-in interface 250 provides a mechanism 900 (shown symbolically in Figure 

J 9) to send the model data from the VAT 200 that is needed to properly execute the model. 

Hi 

The results of the model calculations are then sent back to the VAT 200 where they are 
S interpreted and used by the risk network 500 and presented to the user. All of this happens 

without the user having to launch another program, learn how to use each of the external 
O models, or enter the same information over again in another application. 

O The VAT 200 architecture allows other developers to interface to the VAT 200 and 

2 0 provide new models and capabilities that were not initially built in to the VAT 200. This 
flexible architecture ensures that the VAT 200 is not limited to yesterday's state-of-the-art, 
but rather, that it can be upgraded through plug-ins to take advantage of evolving models and 
data. Much hke the model plug-ins, the data used by the decision network 500, the GUI 202 
screens, and the database 220 itself can be modified by the VAT 200 support organization. 
2 5 Thus, as doctrine or the understanding of the terrorist threat improves, the VAT 200 can be 
readily modified to use this new information. 

The VAT Database 220 can be exported from the system. This will not only allow for 
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back-ups of the data, but also allows the Database 220 to be exchanged among users. This 
will allow Professional Assessors to import an installation's existing VAT Database 220 and 
use that as the starting point for their assessment - thereby eliminating the need to re-enter 
data. 

5 All of the data entered by the user and the information calculated by the system is 

stored in the Database module 220. This information is therefore available for export and 
dissemination to reports and other applications as shown in Figure 10. The VAT 200 will 
provide, at a minimum, the report formats from the JSIVA Report and the AT/FP Installation 
Planning Template. Information from the VAT 200 will be used to populate these reports 
ffio and the user will be able to finish the reports by writing the remaining required text. This 

=^ document will then be saved to the database and will be available in Microsoft Word™ 

III 

format for reproduction. The VAT 200 will also provide the flexibility for users to create 
Jfl custom reports or to save out and print VAT 200 risk assessment reports. 

VAT 200 Editor 

^5 In order to make this modification possible, the AVAT 100 Suite design provides a 

flexible architecture of component modules and a suite of tools (referred to herein as the VAT 
Editor 150) that can be used to modify the system. These tools allow the VAT 200 support 
organization to modify the VAT 200 without having to rely on the system developer or wade 
through millions of lines of code. Since all of the components of the system are tightly 

2 0 integrated with the Database module 220, the VAT Editor 1 50 essentially provides a way to 
modify the existing database 220 to change the GUI 202, Computational Engine 230, report 
output, etc., a shown in Figure 1 1 . 
Theater Information Management System (TIMS) 

The VAT 200 information is also available to Senior Commanders via the TIMS 130 
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to compare among the sites within their area of responsibihty (AOR). The TIMS 130 is a 
web-based application that allows Senior Commanders to view top-level threat, vulnerability, 
and risk data from multiple VAT databases 220. These databases are stored in the TIMS 130 
database that can be located on any web network 1200. The Senior Commander will access 
5 this database through a web browser client on any connected computer 1 2 1 0 as shown in 
Figure 12. Data from the TIMS 130 can be compared, sorted, searched, and graphed. The 
TIMS 130 will be built using industry standard web technologies so that it can be integrated 
with other web applications. 

Through the Plug-in Interface 250, the VAT 200 can also exchange data with other 
fflO applications. This will allow the VAT 200 to import and export data to the JSIVA 

Information System (JIS) and other similar applications. This will ensure that users who 
have an investment in other applications will be able to effectively migrate to the VAT 200 
,5 and that users of all of the apphcations will be able to exchange data. While it may not be 
H possible or desirable to provide an exchange mechanism for all of the data among the VAT 

8E 200 and other systems, the Plug-in Interface 250 will minimize the amount of re-entry of 
^ existing data. 

AVAT 100 Suite Deployment 

The VAT 200, TIMS 130, and the VAT Editor 150 may be deployed for, by way of 
non-hmiting example, the identified users as shown in Figure 13. Figure 13 shows the 
2 0 typical configurations for each user and the interfaces among the users. 
User Interface Desig n 

A preferred embodiment of a VAT 200 interface design is illustrated in Figure 3. 
This design provides a web-like interface. The main content 310 window displays the 
interview, calculated results, and the 3D scene to the user. The panel 320 to the left of the 



main content window 310 provides an outline view for context and to allow the user to 
navigate the apphcation as he/she desires. The toolbox 330 on the far left of the screen 300 
provides ready access to major components of the system including external analytic models, 
the simulation, and output reports. 

Figure 14 and Figure 15 are examples of the types of screens that appear in the main 
content window. The typical Planner Interface Screen 1400, as shown in Figure 14, has large 
fonts, natural English, and establishes context for questions and information before they are 
presented. 

The Risk Assessment Screen 1500, shown in Figure 15, is a notional representation of 
an intelligent natural language representation of risk data provided by the Computational 
Engine 230. This screen 1500 can be customized for each site or user, uses natural English, 
and interprets the risk network 500 data like an expert would. This interface allows the user 
to click on words like "High" to see the underlying information that influenced that 
determination. This screen can be printed or used in custom output reports. 

The Risk Summary Table 1600, shown in Figure 16, provides a powerful mechanism 
for the user to interact with risk data and understand the risks to their site. Clicking on data 
within the table 1600 displays detailed supporting information. Selecting a row allows the 
user to see all of the details for that row or to view a simulation of the event represented by 
that row. 

Chcking on one of the first three column headings from the Risk Summary Table 
1600 makes that column the primary grouping function. This allows the user to see risks 
grouped by weapon, delivery system, and target. Chcking on any other column heading 
makes that column the secondary sort. Therefore, chcking on the "Targets" column heading 
1610 and then clicking on the "Prob of Attack" column heading 1620 would group all of the 



risks by target and sort them according to their probabihty of attack as shown in the screen 
1700 in Figure 17. 

The Risk Detail Screen 1800, as shown in Figure 18, is accessed by clicking on the 
value of any of the calculations represented in the Risk Summary Table 1600. In this 
5 example, the user chcked "High" in the "Prob of Attack" column of the 500 pound car bomb 
against the Headquarters row. This screen shows all of the detailed information for 500 
pound car bombs. The user can click on "more" for any of the statements that support the 
"High" assessment to see the information that they are based on. This data is derived from 
the Risk Influence Network 500. The Risk Detail Screen 1 800 can also be accessed through 
©3 the outline view. 

J After accessing the data in tabular form, the user can then view scenarios in a 3D 

J simulation/gaming environment in order to gain more insight into the threat vector as played 
iO against his/her site layout and countermeasure setup. 

1=^ The 3D Viewer 280 allows the user of the VAT 200 to play various threat scenarios 

against his/her site. The site layout is read in from the database as constructed in the 3D 

m Builder 260. The Computational Engine 230 is then invoked to calculate threat vectors, and 
the resulting data displayed on top of the layout in a three-dimensional view. The user is then 
able to select a vector based on deUvery type, risk value, or other such factors, and play the 
threat against the site in a reahstic manner so that the consequences can be viewed. After the 

2 0 threat vector has been played, the user can then switch to the 3D Builder 260 mode to add 
coimtermeasures, move countermeasures, or make other changes, and then run the 
simulations again as he/she builds up a site layout and plan. Figure 19 displays a simplified 
example of a 3D Viewer Screen 1900. 

The 3D Builder 260 allows the user to construct his base in the VAT 200 system for 
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use with the various modules to calculate vubierabiHty and mitigate risk. The user is 
presented with a palette of standard 3D construction tools, camera movement options, and 
structure types to build. The countermeasure library and structure types are read in from the 
database, and the Hst is presented to the user so he can select a structure to build, maintaining 
5 the notion of a dynamic interface to the user based upon the information in the Database 
module 220. The user then uses the tool to build up the site on top of a base image of the 
layout (scanned-in map, perhaps) or use a base AutoCAD DXF file if applicable, to add 
countermeasures, and to define the site perimeter. 

An exemplary interface to the 3D Builder module 260 of the VAT 200 is shown in 
O-O Figure 7. After all buildings and structures are placed on the map, the road network can be 
'¥ drawn in using hne segments, and any bodies of water can be placed. If any structure 

% requires additional information (such as number of people inside, etc.), the text area below 

5 the 3D view is used for text input that will be stored with the object. The user can then place 

1=== any existing countermeasures such as cameras, guard posts, or jersey barriers for each 

PJ 

ffis THREATCON level to set the site baselines. The site is then saved out into the database 

%y when all structures and countermeasures are placed. 

The process of building a structure is outlined in Figure 20. From the scanned in 
image, or just the bare grid layout, the user selects, point by point, the outline of the base of 
the structure (View 1). The system then fills in the outline and creates a solid 2D polygon 

2 0 (View 2). The user is then able to pull up on this polygon with motion of the mouse to 
extrude the shape into the third dimension up to the required height (number of stories or 
exact height) (View 3), and the system displays a final rendered building with shading and 
textures applied (View 4). Building other structures follows a similar method, with 
differences based on scale/orientation of the object. Smaller objects, or objects that cover 
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large areas are "painted" in using an object brush. For example, water is painted in as one 
would paint with a certain color in a standard 2D drawing program. Jersey barriers, for 
example, are placed one at a time; each "paint spot" showing up as one barrier. Once placed, 
it can then be moved or rotated as desired. 
Influence Network 500 

The Influence Network 500, shown in Figure 5, provides the VAT 200 with a 
knowledge base from which to determine risk. The network 500 is comprised of all of the 
nodes 5 1 0, 5 1 Oa that ultimately affect the risk of a given threat against a given target. A node 
is defined as a piece of data used to influence other data in the network 500. Using 
probabilistic inference, the nodes 510, 510a in the network 500 are combined to calculate 
belief This belief is interpreted as the probability of a certain result occurring, based on all 
of the data available to make a determination. This determination can be made using either 
complete or partial data. Thus, if the user does not enter data for all of the detailed leaf nodes 
510a, the network 500 can adapt to solve the problem based on the data entered. 

One of the more common techniques for representing probabilistic knowledge in a 
network 500 involves Bayesian networks. Using Bayesian techniques, the Influence Network 
500 is made up on a series of nodes 520, 510a with connections between each other. A node 
can have parents (nodes that cause an effect) and children (nodes that are affected), but the 
network 500 can not contain cycles (circular paths among nodes). Nodes without parents are 
considered leaf nodes 510a, and are typically where evidence is added to evaluate the 
network 500. Each node 510, 510a is assigned a set of possible states, along with the 
probability of the state occurring. These probabilities reside in a structure called the 
conditional probability table, and represent the influences of prior beliefs on the decision. 
For leaf nodes 510a, there are no parents to affect the node's state, so the conditional 
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probability table simply contains probabilities of the node occurring. These values are set by 
the evidence assigned from external data. 

Children nodes have effects attributed to them from their parent nodes, so their 
probabiHty tables are far more complex. For each possible combination of inputs from the 
node's parents, the table contains a probability of occurrence for each possible output of the 
node. As evidence is posted to the leaf nodes, the probabilities ripple throughout the network 
500 as belief propagates. Evidence can also be posted to child nodes, and behef can then 
propagate backwards to its parents. This powerful feature allows belief to be refined in the 
network 500 at any level. 

Initially, the conditional probability tables of all nodes in the network 500 are 
initialized to a default state, which is an expected bias in the answers. As evidence is posted 
to the network 500, these probabilities are refined and the network 500 produces answers in 
which we have more confidence. In this manner, partial data can be used to refine beliefs, 
with the initial probabilities responsible for "filling in the gaps" of missing data. Using 
advanced statistical techniques, the confidence of each probability can also be computed. 
This confidence is extremely beneficial for justification of answers. Because of the 
subjective nature of various data used by the system, defense of the system's results is vital. 

Although the probabilistic inference of the network 500 requires complex 
mathematical operations, the structure of the network 500 is simple to represent. This 
presents flexibility in the VAT 200 design, allowing the network 500 to be configurable from 
the object database 220. With this technique, each node 510, 510a of the network 500 is 
aware of its parents, children, and where it receives its data. Using these "smart" nodes, the 
network 500 structure can be stored in the database 220 and manipulated externally by the 
VAT Editor 150. 



By presenting the node structure to the user in an understandable manner, the user can 
modify the behavior of the Influence Network 500. This is extremely beneficial to the VAT 
200, as data refinement is vital to the survivability of the tool. As data becomes available, 
decisions made by the network 500 can be modified to produce answers that are more 
accurate. In addition, if it becomes apparent that more data is necessary to produce an 
answer, nodes can be added to the network 500 to refme beliefs. These nodes can only derive 
their data from the GUI 202, but by adding the node to the network 500 and modifying the 
tables of all nodes that it affects, the network 500 behavior can be altered. 

Data used by the network 500 comes from several different locations. Data entered 
by the user directly into the GUI 202, as well as data resulting fi:om the database and from 
calculations made by the Computational Engine 230, the Dynamics module 240, and external 
models are all used by the network 500. By providing data from various sources, the 
decisions made by the influence network 500 are highly robust, dependent not only upon user 
knowledge, but also on statistics, simulation, and physics. 

Because of the strong involvement between the Computational Engine 230 and the 
Influence Network 500, the Computational Engine 230 is responsible for constructing and 
maintaining the network 500. User inputs to the GUI 202 are posted directly to the network 
500, but the Computational Engine 230 coordinates any other input, resulting from 
calculations or external models. 
Vectors of Approach 

The vectors of approach that are calculated by the VAT 200 determine the 
accessibility of a specific target to a specific threat (an actor with a weapon system). These 
vectors not only provide valuable data to the relative risk determination of the VAT 200, but 
when displayed graphically they provide a powerful tool for the user in imderstanding the 



vulnerabilities to their site. In order to compute the vectors of approach, a specific threat and 
target must be selected by the user. Using this data, the VAT _200 analyzes the threat and 
asset characteristics, the site layout, and the physical security measures to determine all 
possible approach vectors to the target. 
5 The calculation of these approach vectors is a multi-step process that takes into 

consideration the terrain, the layout of the site, physical capabilities of the threat delivery 
system, and the reasoning process of the threat actor. Figure 21 outlines the complete process 
for creating the approach vectors. The primary algorithmic techniques employed in creating 
these vectors are: a weighted graph search algorithm, first-order physics, decision theory, and 
Q 0 pattern recognition. 

^ Using the layout of the site and terrain, the weighted-graph search algorithm searches 

for a path between two points, avoiding obstacles and impassible areas. First-order physics 

J are apphed to ensure realism in the chosen path. Decision theory is apphed to determine the 

reactions of the threat upon encountering countermeasures. Once all of the possible paths 

O 5 have been computed, a pattern recognition algorithm eliminates redundant vectors. 

tff Risk Management 

Risk management support is provided in the VAT 200 by allowing the user to modify 
the site baseline based on the determination of vulnerabilities to specific threats. Once the 
user builds the baseline, characterizes assets and determines specific threats, the VAT 200 

2 0 walks him/her through a susceptibihty determination and consequence analysis. 

Susceptibilities and consequences, coupled with the probability of a specific threat attack, 
make up the relative risk of a target against that threat. In order to perform risk management, 
the user must reduce the susceptibility of a target to an attack, the likely consequences of an 
attack, and/or the probability of the attack occurring. All of these can be reduced through the 
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employment of countemieasures or asset relocation. 

Figure 22 provides an overview of the risk management process. Based on the current 
site baseline and the vulnerabilities determined by the VAT 200, the user is presented with 
countermeasures to employ across their installation. By targeting the placement of these 
countermeasures against the specific vulnerabilities, the user can reduce risk. To assist in this 
process, the VAT 200 analyzes the threat and suggests countermeasures that can best reduce 
the components of risk associated with the threat. Comparing the effectiveness of the 
countermeasure against the threat accomplishes this. Countermeasures that are most effective 
against the threat are presented to the user, along with suggestions for successful 
employment. These countermeasures are not limited to hardening of assets (blast walls. 
Mylar on windows, etc.) but include countermeasures to: 

■ Deter the threat from acting 

■ Deny access to the target 

■ Detect the threat or event 

■ Mitigate the consequences of an event 

■ Interdict the threat 

■ Respond to the event 

As countermeasures are added and removed to affect the risk, the site baseline is 
ultimately modified. The new baseline is then used to produce updated susceptibility and 
consequence determinations. Other risk management options such as asset relocation will 
also be permitted. This cyclic process highlights the iterative natiare of risk management and 
its application to planning. 

The VAT 200 also allows the user to consider costs when managing risk. Preferred 
embodiments the VAT 200 do not provide a detailed cost modeling or cost benefit analysis 
capability; however, for classes of countermeasures the user may select, the VAT Database 
220 is populated with 'initial cost' and 'recurring cost' parameters. The values for these 
parameters are defined as none, low, moderate, or high. The database also contains fields for 



the user to enter dollar costs for specific countermeasures, if desired. These costs can be 
printed in custom reports or viewed in risk summary tables to sort and rank risk mitigation 
strategies by cost. 
Analytic Models 

The VAT 200 uses analytic models to calculate the consequences of likely threat 
scenarios. The Influence Network 500 requires an assessment of the consequences of an 
event in order to calculate the overall risk. For preferred embodiments the VAT 200 potential 
consequences are simply damage to assets and human casualties. From these results, the risk 
network 500 calculates additional parameters such as the mission impact and the symbolic 
victory the terrorist may receive based on biasing values the user has entered for the affected 
assets. 

The VAT 200 User Group selected the models that will be provided with the initial 
release of the VAT 200. The VAT Plug-in interface 250 is also capable of interfacing with 
other models via the Analytic Models Interface. Table A below lists the models that are 
supported by preferred embodiments of the VAT 200. Other models may also be supported. 



TABLE A 

Analj^ic Models 



Analytic Models 


Model 


Sources 


AT Planner 


U.S. Army Engineers Waterways Experiment Station 


FP Tool 


Naval Surface Warfare Center, Dahlgren, Virginia 


Blast/FX™ 


TRW, Incorporation 


Blast Card (Look-up Table) 


TSWG 


HPAC 


DTRA 


CBR Card (Look-up Table) 


Titan Corporation 
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A design goal is to make the interaction of the VAT 200 with external models appear 
transparent to the end user. To support that goal, the VAT 200 provides all of the set-up data 
required by the models in the correct format and interprets the damage and casualties 
calculated by the model. As a resuh, although the data required from the user by the VAT 
200 may be simple, the interaction of the VAT 200 and external models is quite complex. 
This complexity is due to several important issues. 

■ The VAT 200 and each of the analytic models represent the same features in 
different ways requiring complex data transformations. 

■ The analytic models have limiting assumptions that the VAT 200 must track 
and present to users. 

■ The VAT 200 must ultimately accept data from the analytic models. The 
VAT 200 software has no means to validate this data. 

Compounding these issues is that the VAT 200 is written to accept data from models 

that calculate consequences for all kinds of weapons systems. The VAT 200 includes plug-in 

modules that allow interfacing to six models covering blast, chemical, biological, and 

radiological agent scenarios. However, third party developers may produce plug-ins that 

interface with other kinds of models in the fiiture. Therefore, the VAT 200 must consider 

other kinds of models in its use of analytic models. The sections below describe the approach 

that the VAT 200 takes for each of the model interfaces present in preferred embodiments of 

the VAT 200. 

Consequence Model Plug-ins 

Most plug-ins available in preferred embodiments of the VAT 200 pertain to casualty 
estimation and damage assessment. This ensemble falls naturally into two classes: those 
designed for estimating the consequences of blast and fragmenting weapons, and those which 
calculate the consequences of chemical, biological, or radiological weapons. 

The ensemble of blast and fragment consequence calculators is diverse principally in 
the target dimension, the weapons themselves for the purposes of VAT 200 being 



substantially described by their net explosive weight and the presence or absence of efficient 
provisions for fragments. Targets, on the other hand, and particularly buildings, vary 
enormously in their sizes, shapes, construction details, the care in which they were 
constructed, their age, and their outfitting. In addition, siurounding buildings and natural 
5 terrain features can markedly intensify or diminish blast and fragment effects on a given 

building and on its occupants. The presence of buildings can shield people in the open from 
fragments, can channel weapon fragments at some people, and can contribute building 
fragments (especially but not exclusively glass fragments) to the injury-inducing or lethal 
objects flying through the air in the wake of an explosion. 
^0 In contrast to the blast and fragment family of weapon-target encounters, the CBR 

Jk family is knit together by the dependence of all of them on wind-borne fravel from release 

m point to target. In the CBR family the variety is provided by the method of dispersal, 

a meteorological/terrain effects, and by the varying quantities/qualities of the agents 

K= themselves. 

C|5 Conceptual Data Flow between VAT 200 and Blast and Fragment Analytic Models 

^ As Figure 23 illustrates, data is exchanged between Analytic Models and the VAT 

200 through the Plug-in Interface module 250. Blast and fragment analytic models model 
one or several physical phenomena. These include air blast, fragmentation, structural 
response, and casualty or persoimel hazard mechanics. All of the blast and fragment anal3^ic 
2 0 models preferred embodiments address building damage in some fashion or another. In order 
to ftmction they need three categories of inputs or assumptions. These categories are the 
characteristics of the weapon, the characteristics of the building being analyzed, and the 
geometric and geographic context for the weapon and the building. 

A full real-world description of a weapon includes its net explosive weight, its shape, 



-29- 



its containment vessel, boosters such as the presence of bottles of acetylene, and additional 
fragment generators that came with the weapon. Where the weapon is concealed, as in the 
case of explosives concealed in an automobile or in the sides and bottom of a suitcase, the 
distribution of the explosives can affect the shape and power of the explosion. 
5 Buildings have a host of features relevant to the calculation of damage. The detail 

with which the VAT 200 user characterizes buildings may not match the detail for a given 
analytic model. One option is to group buildings into general classes (e.g. two-story, box- 
walled building). This general characterization could be provided to models equipped to 
expand that into a representative building. Alternatively, VAT 200 could do the expansion 
Ci 0 and send the representative building details to an analytic model. For either alternative there 
% will be a reduction of predictive accuracy relative to providing actual details. A contrasting 

m case for building construction is when the VAT 200 user provides greater detail than an 

ifl analytic model is equipped to use. In addition, population within a building, may have 

H multiple representations: the total population in the building, numbers of people in each bay 

fU 

H. 5 of a building, or individuals' specific positions within the building. This discussion 

% highlights the need for the VAT 200 Plug-in to provide the appropriate transformation of 

variables between potentially disparate data fields. 

The geometric and geographic context for weapon-target pairs is also potentially 

much richer than some models are capable of processing. However, the user may not possess 

2 0 all of the information that a model could use to refine its predictions and where the missing 

information is required, either the analytic model or VAT 200 will make reasonable 

assumptions that will be clearly explained to the user. 

VAT 200 expects the following output from blast and fragment models: 

■ Structural damage; 
2 5 ■ Casualty information; and 



■ Information keyed to the geography showing the extent of the various effects 
of the explosion. 

Conceptual Data Flow between VAT 200 and CBR Analytic Models 

Figure 24 illustrates the data flows for the chemical, biological and radiological 
(CBR) plug-in models. The atmosphere is the vehicle for dispersion of CBR agents after 
release. Atmospheric dilution, interaction with water or with other substances in the 
atmosphere, and in the case of biological pathogens, exposure to srmlight, all act to degrade 
the toxicity of one or another of these agents. CBR effects calculations require (in order of 
priority) agent release specifics, meteorological conditions, terrain, and time of day. 

CBR substance release information includes agent type, amount, mechanism for 
release, and delivery mechanisms. The release mechanism describes how and how well an 
agent is aerosolized (e.g., explosive charge, spray, etc.) while delivery mechanism is the 
means of introducing the weapon system to the target (e.g. letter bomb, aircraft, etc.). 

VAT 200 needs casualties and "damage" resulting from CBR attacks. Damage is 
partly the result of casualties, especially casualties to key and essential personnel, but it can 
also be the result of denial of use of facilities or an area and equipment until decontamination 
has been performed. 

Casualty information can be provided several ways. One is simply a count of dead and 
incapacitated. An analytic model provides such numbers on the basis of that portion of 
supplied population databases which applies to the installation in question. A second method 
of expression is to provide geographically keyed data expressing the lethality density of the 
substance as a function of time. From the latter, VAT 200 is able to calculate its own casualty 
information taking into account building-by-building and area occupancy as a function of 
time of day. Even when the analytic model counts the casualties the geographic data is still 
useful for assessing secondary mission impact (i.e. "damage"). It should be noted that 



preferred embodiments of the VAT 200 do not model or use the details of the interior of 
buildings or related heating and ventilation systems so the effects on personnel inside of 
buildings from CBR releases will be approximated by a standard mitigation factor. However, 
standard procedures relevant to minimizing the casualties inside of buildings from CBR 
5 releases (e.g. turn off air conditioning or ventilation system) are provided. 
Top-Level Descriptions of Consequence Model Plug-ins 
Blast and Fragment Models 
Bomb Card 
General Description 

y. 0 TS WG's Bomb Card, analytically represented in VAT 200, provides ranges for 

rC building evacuation and ranges for withdrawal of people in the open. Both are indexed on a 

m progression of common or likely terrorist explosive devices, ranging from 5 pound pipe 

i bombs to 60,000 pound semi-trailer trucks. The building evacuation distances are purely a 

function of net explosive weight. The open air evacuation distances are a composite of 
H5 predicted effects from case shrapnel, thrown vehicle fragments, and glass breakage. 
^ Mechanics of Use 

VAT 200 will supply only type of bomb and net explosive weight in TNT equivalent 
poimds to the Bomb Card model due to the simplicity of the Bomb Card "model" approach 
(i.e., 2L simple look-up table). 
2 0 The Bomb Card does not use any geometric and geographic information beyond the 

XY coordinates of the burst - for example height of detonation and presence of blast walls or 
nearby reflective natural or artificial features are not taken into account. Most importantly, no 
account whatever is taken of the character or construction of buildings. 

The Bomb Card will return information about building damage and potential for 
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casualties to personnel in the open. 
AT Planner 
General Description 

AT Planner, a product of the U.S. Army Engineer Waterways Experiment Station, 
was developed to aid engineers in evaluating Force Protection issues from terrorist and 
saboteur attack. In its native mode it is a GUI-based interactive tool. Features include the 
ability to make building retrofit recommendations and the ability to recommend barriers to 
stop vehicles of a specified size with a specified distance for acceleration. Three-dimensional 
views showing building damage are available in the GUI 202 version and it is possible to 
request standoff distance calculations for specified buildings, specified damage types such as 
roof/wall failure or glass breakage, and for weapons of a specified net explosive weight. 
Mechanics of Use 

AT Planner can use precise positions of persons outside of buildings, detailed window 
distribution information, treats building occupants only by calculating injury potentials in the 
interior bay by bay, and can incorporate the mitigating effects of blast walls close to the point 
of detonation. Threats are specified in net explosive weight of the equivalent TNT charge. 
However, detonations inside of building are not modeled and AT Planner does not use height 
of burst or weapon fragmentation data, and its ability to represent irregularly shaped 
buildings is limited. 

AT Planner's products include casualty information for outside individuals, coded 
panel-by-panel damage information for buildings, and a three-dimensional representation of 
building damage. VAT 200 will use these data to determine detailed consequences for threat- 
target pairs. 
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Blast/FXTM 
General Description 

Blast/FXTM was developed by TRW Inc. (formerly BDM Inc.) for the Federal 
Aviation Administration as a tool to model the effects of explosives against buildings and the 
5 people in them. Features include the ability to predict severity of injury to individuals at 

precise locations inside the building. Buildings may be described in substantial engineering 
and architectural detail and fragment characteristics of weapons are also modeled. 

Weapons can be described by energetic chemical and net explosive weight (describing 
one in terms of the TNT equivalent net explosive weight is sufficient). Fragmenting 
y. 0 capability can be inferred from the casing but also fragment sizes can be specified, so that the 

model can accommodate weapons with bundled shrapnel such as nails. 
m Mechanics of Use 

ifl Of the ensemble of plug- in information pertinent to the general blast and fragment 

consequence projection task, Blast/FX^M is alone among the VAT 200 analytic models in 

III 

H. 5 being able to take into account the specific locations of individuals within buildings. 

Extensive building construction detail can also be used by Blast/FX''"^: beams, 
columns, floors, and walls can be described for multiple levels by dimension, by category of 
material, and in the case of reinforced concrete, by the rebar spacing. Windows can be 
described by size and glazing material. Instead of requiring this level of construction detail 
2 0 from users, the VAT 200 will provide representative construction details corresponding to the 
generic building class selected by the user since preferred embodiments of the VAT 200 do 
not include the modeling of the interior of buildings. 

Blast/FX™'s products returned to VAT 200 include the mortality or severity of injury 
to each person included in the scenario, component by component damage information, and 
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three-dimensional views of the blast area with damage and casualties color coded (plus 
associated data to support this visualization). 
FP Tool 

General Description 

FP Tool is a product of the Naval Surface Warfare Center (NSWC), Dahlgren, 
Virginia. UnUke AT Planner and Blast/FX™, FP Tool uses the TNT Standard methodology 
instead of the Kingery-Bulmash algorithms for its calculations. NSWC chose the TNT 
Standard in order to increase the accuracy of the calculations, especially for reflected air blast 
and elevated burst situations. Of the three blast and fragment models interoperable with 
preferred embodiments of the VAT 200, only FP Tool takes height of burst into account. The 
FP Tool also precisely models air blast-pressure decay but even with FP Tool the prediction 
is apt to be conservative. 

Explosions internal to buildings may be modeled in the FP Tool. Exterior wall panel 
damage is predicted while interior walls are ignored in the calculation of this damage. The 
current release uses eardrum damage and fragment-skin penetration as metrics for air blast 
personnel casualty. The fravel and consequences of fragments of the buildings themselves are 
not modeled in the current release of FP Tool: only casing fragments are considered. 
Fragment trajectories are calculated both for bursts outside and for bursts inside of buildings. 
When a fragment reaches an impediment, penetration is calculated on the basis of the 
fragment and the construction of the impediment. Casualties to people from fragments are 
calculated on the basis of probability of hit for personnel in hazard volumes rather than on the 
basis of precise positions of occupants. FP Tool also calculates probabilities of equipment 
destruction from fragments. 
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Mechanics of Use 

Of the ensemble of plug-in information pertinent to the general blast and fragment 
consequence projection task, the FP Tool can use weapon size, three-dimensional burst 
position information; multiple buildings; and barrier information. Building generic type, 
5 percentage of glass, and population density are usable but more extensive construction details 
are not. Equipment type and fragihty can be used, if provided. 

Results passed from FP Tool to VAT 200 include air blast information, building 
collapse information, building fragment information, building damage information, 
equipment casualty information, and personnel casualty information. 
Chemical/Biological/Radiological (CBR) Models 
j CBR Card 

if| General Description 

iQ The CBR Card provides a quick look assessment for casualties related to the use of 

^* CBR agent releases. The purpose of this application is to provide a range of probable 

Hr 5 consequences from typical CBR attacks. The Card provides actual "Lethal Dosage 50" 
% (L/D50) values for a given release. L/D50 is the dose for which 50% of the affected population 

is likely to die from the given exposure. It should be noted that the casualties will take place 
over a variable time frame depending on the agent: chemical agents act very quickly (within 
minutes to hours) while biological and radiological may take days to weeks to kill. However, 
2 0 the dosage calculation will be determined assuming that the personnel in the area remain 

there for 30 minutes after the release. The CBR Card is meant to provide a rough estimate of 
the consequence from a CBR attack and also to provide insight into crucial aspects of CBR 
releases. While the Bomb Card focused on standoff as the primary countermeasure to blast, 
the CBR Card will show the relative importance of time and situational awareness as critical 
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weapons against CBR agent releases. Time is critical since if personnel can don a gas mask 
immediately upon being notified of a release then the hazard from CB releases is fairly 
minimal. Similarly, for radiological agents, Hmiting time exposed to the agent is the only way 
to prevent casualties for unprotected personnel. 

The primary factors considered in developing the data to create the CBR Card are: 

■ source, 

■ release mechanism, 

■ amount of agent, 

■ delivery mechanism, and 

■ meteorological conditions. 

The CBR Card permits several chemical agents to be selected: chlorine, VX, and GB. 
These three were selected because they span the likely threats in four relevant dimensions: 
availability, persistence, lethahty, and history of use. 

Chlorine is a representative industrial chemical agent meeting the test of easy 
availabiUty. It is a toxic industrial material that has been discussed as a terrorist threat for 
years. It is lethal, its dense gas characteristics enable a cloud to linger in the absence of wind, 
and it is readily available. Moreover large tanker trucks are not uncommon, so inconspicuous 
deUvery is plausible. Because of its likely packaging as a tanker truck the likely scenario is 
for a large amount of chlorine (tens of thousands of kilograms) to be released by a small 
explosive rupturing the tanker near the target. 

The other two characteristics important to chemical weapons are relative lethahty in 
small doses and persistence. No one chemical agent is best at both, so VX is included in the 
CBR card to represent the persistent chemical agents and GB Sarin is included to represent 
the agents of highest lethahty. 

The two conditions of midnight release and noontime release were selected to show 
the disparity between the dispersion and the degradation of CBR releases under differing 



meteorological conditions. Midnight release means no turbulence and no wind. The 
resulting transport and dispersion occurs because of a physical phenomena called meander 
which is the random fluctuation of wind azimuth coupled with random variations of a small 
wind speed. (That is to say, it really is not physically possible to have absolute calm 
conditions.) Meander creates a slow moving erratic cloud that may eventually cover a large 
area. The noontime release conditions provide a turbulent atmosphere with a four-knot wind. 
This condition provides a situation where the initial release will quickly produce a fairly 
directional pliraie of ground effects. The wind speed of four knots was selected to provide a 
reasonable ground footprint over minutes to hours without diluting the release too quickly. 

Unless there is a continual release, turbulence, and exposure to water vapor will cause 
these effects to be fairly short-hved. In comparison to biological and radiological agents, 
chemical agents need to be brought right to the victim in order to work. For them the delivery 
mechanism is an important factor. That is why the CBR Card expands the three representative 
chemical agent cases to a variety of agent/delivery mechanism combinations such as aircraft 
drop, van spray, and suitcase bomb. 

One agent, anthrax, is sufficient to represent biological warfare agents. Anthrax is a 
worst case choice because as a spore it is relatively resistant to ultraviolet light so it has a 
long linger tune (relative to other biological agents) and is also more lethal than most other 
biological agents. It is also readily available and, unlike the chemical agents, it can kill at a 
long distance from its point of release. Three different, plausible delivery mechanisms are 
used - aircraft spray, van spray, and backpack spray. 

For the radiological threat, Cobalt 60 is a likely source due to its availability from medical 
applications. One delivery method is used (suitcase bomb) for its appUcation since in any other form 
it would be very dangerous to the terrorist employing it and an explosive release provides an 



DC:40479.1 



effective way to spread a small amount of material quickly. 
Mechanics of Use 

The two parameters that the CBR Card will require from the xiser will be direction of 
prevailing wind and location of the source. The data produced from the series of CBR scenarios 
described above will be applied to the site within VAT 200 with these two pieces of data. Li this 
way, personnel affected by Hie release may be calculated and provided as a consequence term and, if 
requested by the user, plotted on the site map. The prevailing wind condition is very important for 
CB releases since it specifically identifies the region at risk from a CB release. However, the user 
may experiment using different wind azimuths to determine the severity of a CBR attack during 
non-nominal meteorological conditions (i.e., the user may perform what-if analyses). 

The CBR Card does not consider terrain effects. All scenario runs assume flat terrain. This 
simpUfication could obviously be important especially for very hilly terrain and urban areas. 

The example threats provided in the CBR Card give a broad range of potential threats with 
limited resolution. If any of these scenarios produce event consequences marginally acceptable or 
unacceptable, it is recommended that a more detailed examination of the scenario by considered by 
using the high fidelity CBR transport and dispersion model, HPAC, described in the next section. 
Hazard Prediction and Assessment Capability (HP AC) 
General Description 

The high fidelity transport and dispersion engine within the Hazard Prediction and 
Assessment CapabiHty (HPAC) application normally requires over 100 independent parameters to 
perform a detailed calculation. However, the resolution of the information that will be available for a 
given site and scenario Avill not have much of this relevant information. The source of the release 
must be identified to include agent, agent dissemination device, and amount. HPAC has standard 
attributes of the agents stored in its databases to provide an initial release cloud. The transport and 



dispersion of this cloud, and its resulting lethality, is largely an effect of the environment into which 
this agent is released. VAT 200 does not need terrain and meteorological conditions to run but 
HP AC needs some values for these parameters. HP AC can either determine typical meteorological 
conditions for the site's geographic location and season of the year from its own resident databases 
or a default file will be made available for modification. In addition, the terrain wiU affect the 
transport and dispersion but VAT 200 assumes flat terrain. Data from HP AC will be typical 
contours showing the extent of a cloud's growth scaled to dose levels representative of physical 
impaLrment and/or high probability of death. 
Mechanics of Use 

HPAC is capable of using every bit of the agent cloud, time and meteorology, and 
geographic data that VAT 200 will supply. Some users of VAT 200 will be unable to provide 
information in detail and so will instead characterize weapons, weather, and geography by generic 
category. Together, VAT 200 and HPAC will extrapolate from these to the details HPAC's 
computation engine requires in order to run. 

The present release of HPAC does not directly calculate casualty infomiation. VAT 200 
will receive geographic lethality and incapacitation information from HPAC that it will then use both 
for casualty and for mission impact assessment. 
External Interfaces 

The VAT 200 provides a mechanism that allows end users to enhance the frmctionaUty 
provided by the VAT 200 on delivery. The VAT Plug-in module interface allows third parties to 
create software modules that extend the VAT 200's capabilities beyond those dehvered as part of the 
standard VAT 200 installation. There are currently three variants of plug-in modules: Analytic 
Model plug-ins, Data Analysis plug-in modules, and I/O plug-in modules. The following sections 
discuss the VAT 200's Plug-in module interface and the capabilities of each of the plug-in types in 



an overview fashion that attempts to provide context for the other sections of this specification. 
Plug-in Module Interface 

The VAT 200's external interface mechanism is constructed around the notion of software 
plug-in modules which provide enhanced behavior for the VAT 200 in specific areas of 
5 functionality: new analytic models, new textual data interpretation paragraphs, or new sources to 
import or export data to or from the VAT 200. Software plug-in modules are binary objects built 
from compiled code that adheres to standards defined for the AVAT 100 Suite. 

In general terms, for all plug-in modules, the VAT 200 expects a base level of functionality 
that manages the low-level interface with the VAT 200 software. On top of that fimctionality, the 
^ 0 VAT 200 expects that a plug-in will implement additional functionality that will allow the plug-in to 

provide enhanced behavior for the VAT 200 software. 
5 The overarching design principle for the Plug-in module interface design is to make it easy 

^fl for third party programmers to develop plug-ins for different situations, not precluding the possibility 

^ that more than one plug-in of a particular type (e.g. two analytic model plug-ins and/or three analysis 

B- 5 module plug-ins) may be registered with the VAT 200 and potentially be running concurrently with 
J, the others. 

Analytic Models Interface 

The VAT 200 Analytic Models Interface will allow module developers to create interfaces 
to extemal analytic models and interface them with the VAT 200. Through the Analytic Models 
2 0 Interface the VAT 200 will be capable of exporting munitions, terrain, geometry and other 
information in the VAT Database 220 for analytic models to use in their calcialations. 

A major design goal for this interface is that the user will not be required to interact with an 
extemal model's native interface (if any exists) in order to use it or its results in VAT 200 risk 
calculations. As a result, the VAT 200 Analytic Models Interface provides a number of confrol 
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functions that allow the VAT 200 to control the execution of a compliant Analytic Model. 

After execution, the VAT 200 expects to receive results from the model. The kinds of 
information that an Analytic Model can return to the VAT 200 are listed below. 

TABLE B 
Analytic Model hrformation Table 



Value 


Description 


Consequence to Life 


The effect on the human population in the area surrounding 
the event. This value is used in the influence network 500 
to affect the overall risk value. 


Consequence to Assets 


The effect on the assets affected by the event. This value is 
used ia the influence network 500 to affect the overall risk 
value. 


2D, 3D, and 4D (3D + time) data 
objects 


Data values returned to the VAT 200 that allow the VAT 
200 to visualize the results of a model execution. 


Data Annotations 


Items used to annotate the visualization of data retumed 
from an analytic model. 



Data Analysis Module Interface 

In support of the user created report format reqmrement, the VAT 200 exposes the Data 
Analysis modules interface. The VAT 200 uses Data Analysis modules to interpret the results of 
user-entered data and formulate statements about that data. Throughout the interview process for 
Professional Assessors and Planners and dviring the creation of output reports, the VAT 200 uses 
Data Analysis modules to create custom paragraphs of text. The exposed interface allows end users 
to create their own Data Analysis modules that can be used in user modifled screen sets or in user 
defined output report formats. The Data Analysis module interface includes control methods that 
allow the VAT 200 to interact with Data Analysis modules and exposes portions of the VAT 
Database 220 to allow the module to perform queries on the database. 



lO Module Interface 

The third external interface the VAT 200 exposes is the lO module interface. The VAT 200 
uses lO modules to read and write data from/to extemal data sources. 

Initially the VAT 200 includes lO modules for importing data in the following fomiats: 
TIFF - hnage format JPEG - hnage fomiat 

DXF - Image format BMP - hnage format 

The VAT 200 may also include an 10 module for the following format: 
JIS - The JSIVA Information System 
Output Reports 

The VAT 200 has a report generation capability that assists in the preparation of JSIVA 
formatted professional assessment reports, assessment team briefings, and AT/FP plans. In addition, 
the VAT 200 allows the user to define additional report fomiats that can be used to generate new 
report types in addition to those originally supphed with the VAT 200. The VAT 200 accompHshes 
this by storing report formats that define the information to be contained in VAT 200 generated 
reports in a content independent format. Report formats are editable fi-om within the VAT 200 
Editor. Using the report format editor, \he user can modify any of the report formats supphed with 
the VAT 200 and/or create completely new fomiats that are unlike those supphed with the VAT 
200. 

Professional Assessment Report Generation Capability 

Generation of the report of a professional assessment is an option in the reports section of the 
VAT 200. A substantial portion of the report consists of directly transferred text comments keyed in 
by users. Other portions of the report are available firom the facility physical and procedural baseline 
information maintained in the database as a basis for the VAT 200's calculation. Finally, other 
portions of the report are the VAT 200's calculated results. 



Professional Assessment Team Briefing Generat ion Capability 

Generation of a Professional Assessment Team Inbriefing/Outbriefing is an option in the 
reports section of the VAT 200. As with the Professional Assessment report, the bulk of this report 
is generated based on information entered by the user during his use of the VAT 200. Other 
5 Professional Assessment Team Briefings are supplied in template form to speed the report creation 
abihty of Professional Assessors. 
AT/FP Plan Generation Capability 

Generation of the AT/FP Plan is also an option in the reports section of the VAT 200. A 
substantial portion of the report consists of directly transferred text comments keyed in by users. 
5 0 Other portions of the report are available fiom tiie facility physical and procedural baseline 
J information maintained the database as a basis for the VAT 200's calculations. Yet other portions of 

i-il 

m the report are the VAT 200' s calculated results. 
40 User Defined Report Generation Capability 

H= Report formats are tiie heart ofthe VAT 200' s report generation capability. The VAT 200 

3 5 stores report formats that represent all the report types tiiat the VAT 200 produces. Even the AT/FP 
^ Plans and Professional Assessment Reports that the VAT 200 generates are created using VAT 200 

report formats. Report formats define for the VAT 200 the contents of a report independently ofthe 
information that will ultimately be contained in the reports. Using a report format, at report 
generation time the VAT 200 iterates tiirough user entered site information and assembles a report 
2 0 based on the information. 

Report formats consist of a small set of elements that can be assembled by tiie VAT 200 in 
building block fashion to create a whole document. As shovm in Figure 25, report formats consist of 
Sections 2510, Paragraphs 2520, and Clauses 2530. Major divisions of generated documentation are 
stored as sections in VAT 200 report formats. Sections consist of a title element and one or more 



paragraphs that make up the body of the block. Each section in a VAT 200 report format contains 
paragraphs that define the content of the block. Paragraphs in VAT 200 reports are usually what 
their name impUes - paragraphs of text - although the VAT 200 extends this definition slightly for 
added flexibility by allowing graphs and tables to be inserted as paragraphs 2520. As with sections 
2510, paragraphs 2520 may contain clauses 2530 that define the content of the paragraph 2520. 
Clauses 2530 are the lowest level element of a VAT 200 report format. 

Paragraphs in a VAT 200 report format may be one of several different types. The simplest 
form of paragraph is a boilerplate paragraph that contains text that is constant for all reports 
generated using the report format. Boilerplate paragraphs insert their exact contents into generated 
reports. Another, slightly more complex type of paragraph is the analytic paragraph. Analytic 
paragraphs are created fi-om the output of a Data Analysis module plug-in (see the extemal interfaces 
section for more information on Data Analysis modules). Using Data Analysis modules and 
analytic paragraphs, end users can create completely new forms of output for VAT 200 reports. The 
next most complex form of paragraph is a composed paragraph. Composed paragraphs are 
paragraphs that have one or more clauses that are used to build the body of the paragraph at 
generation time. Composed paragraphs insert the contents of the clauses that comprise them into 
generated reports. Finally, the most complex type of paragraph stored in VAT 200 report formats is 
a special paragraph. Special paragraphs are paragraphs that the VAT 200 creates entirely based on 
information entered by the user as part of their interaction with the VAT 200. Special paragraphs are 
graphs, tables and other forms of data representation that are constructed by the VAT 200 at the time 
of report generation that contain information fi-om the VAT Database 220. The VAT 200 includes 
special paragr^hs that create tables and simple graphs. 

As with paragraphs, clauses can take multiple forms. The simplest form of claiise is a 
boilerplate clause. As with boilerplate paragraphs, boilerplate clauses are copied into generated 



rq)orts unchanged. The second form of a clause is the query clause. Query clauses represent simple 

database queries. At report generation time, the query is conducted and its results are what is 

inserted into generated reports. 

Software Architecture 

Object Model and Architecture 

The VAT 200 software accepts and stores a multitude of data elements including user input 
data, analytic model results and influence network 500 evaluation results. In order to provide 
structure to that data and make it available to all of the parts of the VAT 200 system that may need 
it, there are three models the VAT 200 uses to organize information. One of these models, the 
Influence Network 500, has been specifically discussed previously due its central influence on the 
VAT 200's complex risk calculations, hi addition to the Influence Network 500, the VAT 200 
maintains a Data Model, which contains information about the physical elements of a particular 
domain, and the Meta Data model. This section describes each of these models, their relationship to 
the other models, and how flie VAT 200 uses them to develop a complete representation of a site. 

The VAT 200 Data Model 2600, shown in simphfied form in Figure 26, is how the VAT 
200 organizes information about the real-world elements that can exist in the site under analysis. 
The association of physical items, agents, and events as the association element called AT/FP 
Domain forms the base of the diagram. Each of the branches of the tree represents an orthogonal 
view of the world that represents items from the most general to the most specific. In this context, 
physical items are real objects in the world that occupy space. For example under this organization, 
one could say they have a physical object, which is a vehicle, which is a land vehicle, etc. proceeding 
from the most general to the most specific. Agents represent entities in the world that have intent 
and perform actions. An example agent would be the U.S. Army or a terrorist organization. Finally, 
events are triggers that are likely to bring about change in the world state or cause an agent to act. 
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An example would be a coup or the occurrence of a religious holiday. 

The VAT 200's second use of the Data Model 2600 is to use instances of elements of the 
Data Model 2600 as part of associations that are part of the VAT 200's Meta Data Model (shown in 
Figure 27 and described below). These element instances represent items that actually exist as part 
5 of the profiles that the VAT 200 is being used to create. 

The VAT 200's Meta Data Model 2700, shown in Figure 27, is the VAT 200's central 
aggregation mechanism for data about sites that the VAT 200 profiles. The VAT Meta Data Model 
2700 stores information about the collections of elements firom the Data Model 2600 that are useful 
in the AT/FP domain. The structure of the Meta Data Model 2700 is primarily based on associations 
J'S 0 since it focuses on bringing together objects into real world constructs. 

-J At the root of the ti-ee are the organizational elements Agency 2710, Region/Division 2720, 

m and Site 2730. These objects provide for storing contextual information about a site and allow the 

TIMS 130 to properly associate sites that are under the same Agency 2710 or in the same Region or 

Division 2720. 

3. 5 Sites 2730 are composed of a Site Layout 273 1 and one or more hiformation Products 2732, 

S Threats 2733 and Site Baselines 2724. The VAT 200 uses the Site Layout 2731 to store all of the 

static information about a site's inJfrastruchjre, stinctures, and natural environment. Conversely, Site 
Baselines 2724 are used to store data about the dynamic elements of a site such as employed 
countermeasures, asset locations, and organizations as these elements are organized for a particular 
2 0 configuration {e.g. one may speak of the THREATCON Alpha basehne versus the THREATCON 
Bravo baseline.) 

The VAT 200's final organizational element, as described previously, is the Influence 
Network 500. The Influence Network 500 provides a central fiamework fi-om which the VAT 200 
evaluates risk. Each of the nodes 510, 510a in this network 500 represents an element that affects 



the overall risk for a given threat against a given target. Nodes in the network 500 can have parents 
(nodes that cause an effect on this node) and children (nodes that are affected by this node), but the 
network 500 cannot contain cycles. Using an influence algorithm (described fliUy in the Influence 
Network 500 section), each of the nodes in the network 500 takes a set of possible states, each with a 
probability of occurring. Ultimately, the values at children nodes are influenced by the values in 
parent nodes in the network 500. 

As shown in the Figure 28, the VAT 200 populates the leaf nodes 510a of the hifluence 
Network 500 using a combination of directly entered data, data pulled directly from the Data or 
Meta Data models 2600, 2720, and calculated information based on data gained from network 500 
searches. As a consequence, data entered into the Data Model 2600 and the Meta Data Model 2700 
directly or indirectly affect the site specific hifluence Network 500 and therefore affect the site's 
overall risk profile. 

To implement the behaviors implied by these three models, the VAT 200 is divided 
intemally into nine subsystems that each implement a part of one of the data models, the influence 
model, the user interface, or other systems that operate on the models to perform useful calculations. 
The subsystems are identified in the next section and defined in detail in later sections. 
Package Diagram 

The VAT 200 is intemally divided into nine subsystems. Each of these subsystems is 
implemented as a separate software package with a public interface that the other subsystems use to 
interact with the package. The VAT 200 Package Diagram 2900 in Figure 29 shows the VAT 200, 
its subsystems, and Iheir dependency relationships. The block symbols {e.g. GUI Engine 210) 
represent aggregations of functionahty within the VAT 200 that will be implemented as a subsystem 
with specific defined interfaces. The dotted arrows show which of the VAT 200's subsystems 



depend on others. For each of these dependencies, the lower level package (at the arrowhead end of 
the arrows) will implement an internal system interface. 

hi addition to the VAT 200's internal interfaces, this diagram shows the external iaterfaces 
that have been defined for the VAT 200. These interfaces are discussed in the section above entitled 
5 External Interfaces. 
Subsystems 
GUI Engine 

In order to provide a user interface that is tailored to multiple types of users and that can be 
modified without recompiling, the VAT 200 uses a GUI Engine 210. Instead of producing an 
y. 0 interface based on compiled code, the GUI Engine 210 reads and creates the user interface firom the 
m database 220 at run-time. This approach provides a GUI 202 that can be modified by changing the 

IJ1 database 220 instead of the code. It also provides the abihty to define different user interfaces for 

® each type of user. This allows the interfaces to be customized to fit the user's specific needs and 

jr= level of understanding. 

[fl 5 The current user interface concept has five main sections menu bar, navigation bar, tool 

£ interface, outline view, and dynamic content area. Each of these sections are created and managed 

by the GUI Engine 210. 

The menu bar provides file inpuf output commands, edit functions, simple navigation, and 
access to help. The GUI Engine 210 passes the commands to the appropriate VAT 200 subsystems 
2 0 and interacts with the Windows chpboard as requested by the user. 

The navigation bar provides the user with web like navigation (back and forward buttons) 
and quick access to important features and sections of data in the VAT 200. The GUI Engine 210 
stores a screen history that it uses to determine what screen to display when the back and forward 
buttons are used. They act exactly like the buttons found on a web browser. The remaining buttons 
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on the navigation bar are linked to specific screens in the VAT 200 that are immediately displayed 
when the user presses them. 

Similar to the navigation bar, the tool interface provides direct access to various tools 
contained in the VAT 200. Each of the buttons, when pressed, instructs the GUI Engine 210 to 
5 activate a specific VAT 200 tool and display its interface. 

The outline view's two purposes are to represent the data in the system and to allow the user 
to move around in the VAT 200 to view, edit, and change data. The GUI Engine 210 populates the 
outline as data is entered into the system and as the VAT 200 needs information fi-om the user. The 
information is displayed in an outline form to better organize and manage its representation. 
% 0 Users can use the outline to jump to information that they need to change or enter simply by 

j|1 clicking on a line in the outline view. This instmcts the GUI Engine 210 to display the screen that 

m contains the proper information. 

%0 The most important part of the interface is the dynamic content area. This portion of the 

interface contains the screens that: 

f%5 ■ Interview the user 

J ■ Allow the user to view and modify data 

2 ■ Display results, charts, and graphs 

■ Display 3D graphics for building the site and simulating it 

The GUI Engine 210, shown in Figure 6, reads information from the database and creates 
2 0 screens to allow the user to interact with the system. This area, like the rest of the interface, is 
completely controlled by the GUI Engine 210, but the 3D Engine 210 is also capable of writing 
information to it. Whenever the 3D Builder 260 or Viewer 280 is needed, the GUI Engine 210 
provides a gr^hics context to the 3D Engine 210 so that it can display graphics in the dynamic 
content area. The GUI Engine 210 creates and manages all the toolbars that are required to operate 
25 the 3D Builder 260 and Viewer 280. It passes the commands issued by the user to the 3D subsystem 
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for processing. This provides a consistent interface to the user and relieves tiie 3D sub-system from 
the duties of handling user input. 

The GUI Engine 210 handles multiple screen definition sets so that each one can be 
customized to fit a specific set of users, but it does not require that every screen be customized. 
Instead the engine supports default screens in addition to user type specific screens. This provides a 
mechanism where the GUI Engine 210 uses a default screen anytime a user type specific one does 
not exist. This makes the engine 210 more flexible and defining custom screens less time 
consixming. 

Each object in the system that requires user interaction has a least one screen associated witii 
it. This is the default screen to be used by the GUI Engine 210. In addition to that screen each 
object can have other screens associated with it to be used by a specific type VAT 200 user as shown 
in Figure 30. 

As mentioned throughout this section, the GUI Engine 210 uses screen definitions to define 
what the dynamic content area of the user interface should contain. These definitions define what 
the screen should contain, but not explicitly how it should be displayed or laid out. This has two 
main advantages: 

■ The user interface is more flexible. 

■ Defining screens is much simpler. 

The screen definitions such as the definition 3100 shown in Figure 31, consist of a list of 
what should be shown on the screen, but not how it should be laid out. This approach frees 
modification users from the duties of having to graphically lay out each screen so that fhey can better 
concentiate on the content of the screen. It also allows the GUI Engine 210 to be more flexible by 
allowing it to adapt the screen to the size and style of the window available. It fiarthermore allows 
the engine to decide, based on the type of data to be input to output, what is the best way to display 



The GUI Engine 210 uses the screen definition 3 100 to determine what to display on the 
screen. To determine how to display the information, it checks the type of data and determines what 
input or output device to use. For example, if the definition 3 100 specified that the user's name 
should be entered, the GUI Engine 210 would check the database and know that this is a string. It 
would then use a text-input box on the screen for the user to type the information into. If on the 
other hand the definition 3100 specified that the user's rank be entered (and a list of acceptable ranks 
exist), the engine would use a selection box so that the user would not need to type in the answer. 
This technique is appHed to all of the items in the list until the entire screen composition is known. 

At this point the GUI Engine 210 uses rules similar to a web browser to layout the 
information on the screen. It determines the spacing between lines, knows to emphasize the title of 
the screen, etc. Once this process is finished, the engine displays the screen to the user and handles 
all the interactions. 

In addition to interpreting the screen content, the GUI Engine 210 is also responsible for 
determining what screen to show when. The user can jump to specific screens by using the 
navigation bar, outUne, and tool bar, but this is only part of the navigational process. During the 
interview for example, the user will press a done or next button to indicate that they are ready to 
proceed to the next screen. The GUI Engine 210 is responsible for finding it. 

There are three methods that the engine uses during navigation. The first is to jvimp to a 
user-specified screen as described above. The second is to look at data dependencies in the object 
model and influence network 500. Many of these objects require information about other objects. 
The GUI Engine 210 uses this information to determine what object screen the user should see next. 
But, this method alone may not produce a coherent progression of screens. 

The GUI Engine 210 is equipped with one final navigational method. In addition to 
specifying what to display on a screen, a screen definition can also specify other screens to be 
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displayed. This allows it to override the default behavior of the system in order to provide a directed 
screen progression. A sample diagram of this process is shown in Figure 32. 
Computational Engine 

The Computational Engine 230 subsystem of the VAT 200 is responsible for providing 
support to the risk determination and mitigation processes. During these processes, the 
Computational Engine 230 builds and maintains the stincture of the influence network 500, in 
addition to performing calculations to support decision-making. Figure 33 illusti^tes the many steps 
of risk determination and analysis with which the Computational Engine 230 is involved. 

The key to the knowledge of the VAT 200 lies in the Influence Network 500. This network 
500 embodies the factors that the VAT 200 relies upon in making decisions during risk 
determination and mitigation. Risk determination is composed of four major components: criticality 
determination, threat determination, susceptibiHty determination, and consequence analysis. Risk 
mitigation is comprised of countenneasure effectiveness analysis and consequence analysis. Each of 
these distinct components interacts with the influence network 500 in order to make decisions, and 
each decision made affects the rest of the Lifluence Network 500. Through the data interaction 
between these components, the Influence Network 500 is capable of calculating the relative risk of a 
particular target against a particular threat. Figure 34 illustrates the interaction between these steps of 
the risk process and the Influence Network 500. 

In addition to interacting with the primary VAT 200 Influence Network 500, the 
susceptibility determination and risk mitigation components also make use of local networks in order 
to make complex decisions, as shown in Figures 35 a, b. During the susceptibility determination, 
threat intentions and capabilities are compared to countermeasure effectiveness to determine the 
reaction of the threat upon encountering a countermeasure. This complex inference is handled using 
a miniature Influence Network. Similarly, risk mitigation also uses threat and countermeasijre 
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characteristics in making decisions. Various countenneasures are compared to the specific threat to 
determine which ones are most effective at mitigating the risk of the threat against the target. These 
local decisions do not directly derive fi-om the prime hifluence Network, so they are handled 
independently. 

The structure of this network is used to control the progression of the screens shown to the 
user, and the data collected by the network 500 determines the resulting output. The network is 
capable of propagating data through itself in order to make decisions, but it must rely on external 
means to obtain this data. The GUI 202 provides a portion of this data directly fi-om the user through 
elements on the screen. The remaining data is the result of various calculations performed by the 
Computational Engine 230. Figure 36 depicts the relationships between the nodes of the influence 
network, the data connection with the GUI 202, and the calculations made against the data model. 

The primary calculation that the Computational Engine 230 is responsible for is the 
generation of approach vectors. These vectors represent the many ways in which a threat can reach 
the target in order to attack. Based on tiiese vectors, the accessibiUty of the target is calciilated and 
used in the influence network 500 to determine relative risk. Figure 37 outlines the steps necessary 
to construct these vectors. 

There are six primary steps to building approach vectors. Step 1-37 involves computing the 
range firom the target tiiat the threat must reach in order to affect consequences. Step 2-37, which is 
in reality the conti-olling loop of the process, involves using a weighted graph search technique to 
build the path. This technique takes two points and builds a path between them. In building the 
path, the algorithm seeks to minimize cost, which in this case is the number of countermeasures that 
it must face, and maximize effectiveness, or the resulting consequences to the target. 

Steps 3-37 and 4-37 are actiaally responsible for supporting the weighted graph search 
algorithm. Step 3-37 involves the actual reasoning component tiiat deals with countermeasures. 
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Using a local version of the influence network 500, the search algorithm can evaluate the response of 
the threat to the countermeasure(s), and if necessary, can alter the path based on the results. Step 4- 
37 involves the appUcation of first-order physics to the threat dehvery mechanism. By using physics 
provided by the Dynamics module 240, the weighted graph algorithm determines the types of terrain 
that the dehvery mechanism can cross, and the areas that the mechanism can fit through, hi addition, 
the local influence network 500 makes use of physics to determine the denial capabihties of the 
countenneasure(s) against the threat, hi a later post-processing sequence, tiie Dynamics module 240 
calculates the speed and timing of the threat along the path, for use in later playback. 

Step 5-37 of constructing vectors consists of refining the many paths that are produced. 
Invariably, similar and redundant vectors are generated, differing only slightly fi-om other vectors 
and not providing useflil data to the process. Using pattem-matching algorithms, these extraneous 
vectors are removed in order to simpHfy the final representations. Finally, in step 6-37, the 
accessibihty value of the threat to the target is calculated for each vector. Once all of the interesting 
vectors have been constmcted, the accessibility of the site is computed based on the accessibihty 
values of all vectors. This value is used directly by the influence network 500 to determine relative 
risk. 

Dynamics module 240 

The Dynamics module 240 is responsible for calculating and updating the state of the 
physical objects during the simulation of the threat ingress, given realistic physical properties of the 
environment and objects acting in the environment. 

The Dynamics module 240 is the set of code that modifies and stores the state vectors of all 
objects. A state vector is a set of physical characteristics and measurements that describe completely 
the current configuration of a given object. For example, the state vector used in the VAT 200 
includes position in three-space, a rotation quaternion to describe the rotation of the object, the linear 
momentum, and the angular momentum. This state vector is then updated every computation cycle 
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of the Dynamics module 240 as external forces interact with the object and impose a change on the 
state vector configuration. 

The Dynamics module 240 has three main sections. The first represents the object itself 
The otiiers act on that object and are labeled as the Force Accumulator and the Equation Solver. For 
each cycle of the computation the object sends a message to the Force Accumulator module to sum 
up all forces acting upon the object. The Force Accumulator has knowledge on how to calculate the 
various forces in accordance with the Lagrangian dynamics equations (dynamics equations based on 
energy conservation). For example, the Accumulator will access other objects if there is a colhsion 
force, or access only the gravitational constant if it is the gravitational force desired. The total force 
vector is then passed back to the object. Figure 38 shows a complete module diagram and data flow 
outline. 

From that point, the Equation Solver takes the time derivative of the object's state vector at 
time tg, adds in the force as accumulated earlier, and integrates over a given time step At to result in a 
final state vector at time tj = tp + At. The Solver uses an implicit method of solving the ordinary 
differential equation and utilizes dynamic time steps to minimize errors that occur in stiff Ordinary 
Differential Equations (ODE) (those that can "blow up" during standard explicit computational 
methods with too large a time-step). 

The Dynamics module 240 is able to simulate any simple physical phenomena, such as 
object-object colUsions, gravitational acceleration of an object, fiiction and resistance effects, and 
deformation events. The physical object as stored in the Dynamics module 240 has a volume 
(spatial extent), mass, and a state vector as described above. 
VAT 200 Database 

In order to store the many sources of data used throughout the system, the VAT 200 
employs a relational database. With a relational database, the VAT 200 is capable of saving data 
from previous sessions for the user to access later. In addition, the database provides a fi-amework 



for sharing data between modules in the system, and between users at different locations. Figure 4 
STjmmarizes the many different types of data stored in the VAT Database 220. 

The VAT Database 220 operation must be totally transparent to the typical user. This is 
because the architectural requirements will not support the traditional model where a database 
5 administrator manages the database independent of the application. The VAT 200 system is unique 
in the sense that it must operate in both standalone and traditional multi-tier modes. Therefore, the 
VAT Database 220 is designed in such a way as to provide data storage capabiUties that are 
transparent to the user and require zero maintenance. 

VAT 200 architecture is predominantly object-oriented in nature. A relational database is 
% 0 not object-oriented, but is organized by tables. In order to implement an object-oriented application 
m design the use of a relational database conversion code is required. The code is commonly referred 

m to as a 'mapping' code because it is used to map the apphcation objects to relational entities in the 

%0 database. Depending on the application, the effort to develop the mapping code can be substantial. 

tr. The goal of the VAT 200 is to minimize the mapping code effort, while maintaining complete 

H 5 functionality with vendor independence. Figure 39 depicts the object-to-entity relationship. 
'% The VAT 200 application incorporates a database broker to perform the necessary object-to- 

relational mapping functions. The broker is a distinct module in the VAT 200 apphcation 
performing mapping functions, therefore encapsulating database access code. This approach 
provides a transparent conversion of the relational model into the VAT 200's object model. 
2 0 Modifications to the relational model only require modification to the broker. 

The database broker handles all data storage and retrieval functions for tiie VAT 200 
application, therefore housing the necessary database communication code. Regardless of the 
selected database, the interface between the VAT 200 application and broker remains constant. 

The relational data model is implemented by defining relational entities for the VAT 200 
2 5 object classes as shown in Figure 40. Each entity is designed to support the object model as 



efficiently as possible. The methods and aggregation features of the object model become 
incorporated into the database broker. The relational data model begins as a logical model defining 
the necessary entities and appropriate relationships between. 

From the logical model, physical models can be created for any supported relational 
database. 

3D BuilderA^iewer 

The VAT 200 contains the capability to render a site layout in a three-dimensional manner. 
This includes two modes of operation. The first is a 3D view that allows the user to construct a site 
or add objects to a site (3D Builder 260). The second allows the user to view a simulation run in a 
3D environment (3D Viewer 280). The Builder 260 and Viewer 280 are two modes of operation 
built on top of the 3D Run-time environment 270, which is based on the OpenGL graphics library. 
Both use the same underlying rendering techniques, while presenting to the user different 
fimctionaUty. This allows the code base to be shared between the Builder 260 and the Viewer 280, 
resulting in a smaller memory footprint, easier transition between Builder 260 and Viewer 280 
portions of the VAT 200, and a consistent 3D interface. 

The 3D Bmlder 260 allows the user to construct his base in the VAT 200 system for use 
with the various modules to calculate vulnerability and mitigate risk. The user is presented with a 
palette of standard 3D constmction tools, camera movement options, and structure types to build. 
The countermeasure hbrary and structure types are then read in from the database, and the list 
presented to the user in an appropriate menu so he can select a structure to build. The user then uses 
the tool to build up his site on top of a base image of the layout (scanned-in map, perhaps) or use a 
base AutoCAD DXF file if applicable. A flow diagram of the builder process is shown in Figure 41. 

The Viewer 280 allows the user to view the site layout as constructed in the Builder 260, 
then displays the results of the computational cycle that calculates risk to various assets on the 
layout. This information is displayed as "threat vectors" on the layout, or representations of paths 



that a threat delivery mechanism would take. Each of these paths can be selected by the user, and 
the threat scenario can then be played out, including the consequence display at the end based upon 
data received from the extemal blast or CB models. A flow diagram of the Viewer 280 process is 
shown in Figure 42. 

The 3D Viewer 280 and 3D Builder 260 both sit on top of the base 3D Run-time engine as 
outlined in the previous section. Each interacts with different sub-modules of the Run-time to alter 
the user interaction, rendering mode, and display options. The Viewer 280, while interacting with 
the Computational Engine 230 and Dynamics module 240, communicates with the non-physical 
data structures to populate the threat vector display list. It also interacts with the camera model to 
change the view upon user request, as well as makes calls to the rendering engine itself to change 
display modes (switch to wire-frame mode, map textures differently, et cetera). The Builder 260, on 
the other hand, needs to access the structure of static data to populate the terrain and structure 
information (static polygons), while also communicating with the rendering engine and the camera 
model. 

The Builder 260, upon initial startup, takes input from a 2D image or a 2D AutoCAD file 
(DXF). This is then used as the base of the modeling session, which allows the user to build on top 
of the actual site layout in order to bring it into the third dimension. The DXF file is parsed and 
translated into an intemal format, and all 3D information generated by the Builder 260 is kept in an 
intemal format for maximum efficiency. When the user is finished, tiie model is then saved out into 
a common 3D file format that can be stored into the data store (object persistence mechanism), and 
pulled up later in the Viewer 280. All asset characteristic information is imbedded into tiie 3D-file 
format so that all information is in one location. 
3D Run-time Environment 

Both the 3D Viewer 280 and the 3D Builder 260 are based upon the same 3D Run-time 
Environment 270 (also referred to herein as the 3D simulation/gaming environment) that handles tiie 



rendering of the scene. The 3D engine stores texture information, polygonal models, and lighting 
information needed to render the scene quickly and realistically. A detailed look at the sub-modules 
of the 3D-Run-ttme Environment 270 is found in Figure 43. 

The 3D Engine takes input Irom the database to retrieve the site layout as built by the 
Builder, or from the current polygon stmcture that the user has constructed in the case of the Builder. 
The texture images are stored and linked from individual polygons, and the geometry of the layout 
and buildings are stored separately from the geometry of the mobile objects such as tmcks. The 
polygons for static data such as the terrain and buildings are stored in a manner that is geared toward 
quick rendering, while the objects tiiat move do not necessarily remain in the same physical area 
during the simulation, and so cannot take advantage of the spatially-ordered data structure. A Binary 
Space Partitioning (BSP) tree is then used to store the terrain and structure polygons to allow for the 
quickest rendering of a large scene while allowing for rapid view-fiustum culling and level of detail 
control. BSP trees allow all polygons to be stored in a free stmcture that is branched based upon 
spatial position, so polygons close to one another in physical space are close in data space as well. 
These techniques are used to allow for faster rendering speeds on the limited hardware of the PC 
platform. 

The models used to draw all auxiliary vehicles and stractures are kept in a model library 
within the 3D-rendering module to facilitate tiie addition of new models. The tmck models, for 
example, will not be stored integrated in with the site layout, but v^dll be stored separately to allow 
addition or changes to the tmck model. The site terrain and additional geometry are exportable to a 
common model interchange format (DXF) for viewing in an extemal model viewer independent of 
the VAT 200. 

The rendering engine uses the OpenGL graphics Application Programming Interface, or 
API. This Ubrary of graphics routines has become the industty standard for fast real-time graphics, 
and is supported by most video hardware to provide acceleration and keep most of the graphics 



pipeline processing tasks off of the CPU. OpenGL provides a robust set of primitive calls to render 
polygons with realistic lighting, shading, and texturing effects, z-buffering, and other advanced 
graphics features. The graphics libraty lends itself to a scene graph approach for storing polygons 
and transforms internally, while also allowing for a BSP tree or other spatial structure to exist 
internally since OpenGL does not deal with higher-level polygon sorting or organization. A scene 
graph is a technique used to store rotations and translations in a tree structure. This structure allows 
changes at a higher level to affect all objects below the node; organizing rotations and translations in 
an efficient manner. 
Report Generator Module 

The Report Generator module of the VAT 200 is responsible for the creation of electronic 
and printed ou^ut from the VAT 200 system. The report generator is driven based on inputs from 
the user interface that indicate the report type to generate and the desired output format. The report 
generator always operates on the active dataset for the VAT 200. 

The Report Generator module is built around the design concepts expressed in the User 
Defined Report Generation Capabihty section. As described in that section, report formats form the 
heart of the report generation capability whose structure is reflected in its class hierarchy as shown in 
Figure 25, Report Format and Figure 44, VAT Report Generator module, hi addition to the Report 
Format, Section, Paragraph and Clause object classes discussed in the User Defined Report 
Generation Capability section; the Report Generator module adds a class for the report that forms the 
public interface for creating reports in multiple formats, a report generator class that forms the public 
interface for the subsystem, and several subclasses which implement the specific behaviors for 
paragraph types, clause types, and output formats. 

The report generator object defines the public interface for the Report Generator module. It 
is the only object in this subsystem that persists throughout a VAT 200 execution. Other objects in 



the subsystem are instantiated and destiroyed as necessary when generating reports or creating user- 
defined report formats. 

The report object is an abstract object that is never instantiated, histead, it defines the public 
interface to several subclasses that deal with the specifics of particular output formats. This indirect 
5 approach allows the VAT 200 to be more easily expanded in the fixture to include support for 

additional output file format types. Initially, the VAT 200 will be capable of creating documents in 
RTF, and Microsoft Word 97 TM formats. 

A similar approach has been taken with the paragraph and clause objects. Abstract base 
classes form the interface to these classes, while specific subclass objects allow for specific 
Q. 0 behaviors for different paragraph and clause types. 

When the user requests to generate a report, the GUI 202 sends the report format, the desired 
output type, and optionally, an output file name. Report generation occurs in two stages: 
5 qualification and creation. During the qualification stage the report generation subsystem performs a 

1=^ walkthrough of the report format and verifies that each Section, paragraph, and clause has enough 

CI 5 information to create its ou^ut. If quaUfication succeeds, then the subsystem actually creates the 
^ report. 

If quahfication fails, then the subsystem returns with a failed qualification message. Reports 
that fail quahfication may still be generated, however, some information may be indicated as being 
missing or incomplete. During generation of a report for which the format quahfication failed, those 
2 0 sections, paragraphs, or clauses that failed will insert a qualification failure message in the output 
report that indicates that the required source data was not available. 
Plug-in Interface 

The VAT Plug-in Interface 250 exposes portions of VAT 200 fimctionahty to allow end 
users to enhance the capabilities of the VAT 200 beyond those that are dehvered with the VAT 200. 
2 5 The VAT Plug-in Interface 250 subsystem exposes four interfaces which collectively allow the user 
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to enhance VAT 200 behavior in three areas: adding additional analytic models, adding additional 
textual interpreters, and adding additional data input and output converters. In general terms, plug- 
ins are self-registering Microsoft COM objects that implement the VAT Plug-in hiterface and at 
least one of the other VAT Plug-in Interfaces 250. 
5 The static structure of the VAT Plug-in interface 250 subsystem is shown in The Plug-In 

Interface Class Structure as shown in Figure 45. The plug-in interface is structured to support the 
four exposed interfaces; each extemal interface is represented intemally by a class that provides the 
methods to interact across the interface. In addition to the interface classes, a higher level class plug- 
in interface implements control for the plug-in interface and provides the public interface for the 
% 0 VAT Plug-in Interface module 250. 

J During VAT 200 startup, the VAT 200 initializes the VAT Plug-in hiterface module 250, 

in which then proceeds to register all plug-ins that are located in the VAT 200 system plug-ins 

s 

m directory and those in the user plug-ins directory. Each registered plug-in is then started by the VAT 

J* 200 to allow it to perform any resource allocation and startup processing that may be required. After 

Hl 5 VAT 200 processing has completed, this process is reversed. Each plug-in is shutdown to allow it to 
free any resources it may have acquired during the VAT 200 execution, and the VAT plug-in 
interface 250 is shutdown. 

Run-time processing varies depending on the type of plug-in. As shown in Figure 46, while 
the VAT 200 is running the plug-in is dormant. When the user requests an analytic model 
2 0 execution, however, the plug-in proceeds through three states. The pre-execute state allows a plug-in 
module to perform any data gather/reformatting required for an impending model execution. After 
completing pre-execution processing, the VAT 200 proceeds through the execute state wherein the 
VAT 200 would actually execute the extemal model, and the post execute state where the VAT 200 
allows the analytic module plug-in to perform any post processing and data collection. 
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TIMS 

Interface Design 

The TIMS 130 is composed of seven screens: 

■ Login screen 

5 ■ Welcome (splash) screen 

■ Browse screen 

■ Search screen 

■ Summary screen 

■ Compare screen 
10 ■ Notes screen 

The login screen allows the user entry into the system based on a login ID and a password. 

Once logged in, a splash screen welcomes the user to the system and offers a hst of possible menu 

y selections. The browse screen 4700 is shown in Figure 12. The browse screen 4700 gives the user 

Ik tiie ability to sort the site entries based on several different methods. The user can also search the 

yl 5 sites for particular information using the search screen. Once the user had decided upon a particular 

© site and report, the summary screen outlines all of the information available from that site. Using the 

compare screen, the user can perform side-by-side comparisons of different report entries, either 

from the same site or from different sites. At any time, the user can capture comments or memos for 

later use with the notes screen. 

2 0 Software Architecture 

The TIMS 130 provides the user the capabiUty to view individual VAT 200 sessions from multiple 

sites. The TIMS 130 also allows the user to sort, search and browse the data from the individual 

VAT 200 sessions by categories such as threat type, risk, score and others. 

Figure 12 is an overview of user interaction with the TIMS 130. Results from local VAT 

2 5 200 sessions are fransferred to the TIMS 130, in the form of the VAT Database 220, and stored in a 

database along with sessions from other sites. The TIMS 130 user can then analyze these various 

sessions using several browse and search techniques. Each session is viewable by selecting the 

Summary option, which displays a brief overview of the session's report and the information 



collected during the session presented in the form of charts and tables. At any point, the user can 

access a notes screen to capture comments for later review. 

The TIMS 130 database architecture is similar to the local VAT 200 with minor 

enhancements in order to support the TIMS 130 operational requirements. The TIMS 130 is 
5 implemented on a high performance database server supporting multiple clients. The TIMS 130 

database is designed to support the storage and access of multiple VAT 200 sessions from multiple 

sites. Each session is individually identified within the database supporting the TIMS 130 

operational requirements. The Database Management System (DBMS) handles data concxirrency, 

integrity and user authentication of the TIMS 130 sessions. 
% 0 Through the user-friendly interface of the TIMS 130, the user can perform many tasks to 

S understand the information collected from the local sites, including: 

Ijl ■ Browsing data - The user can scroll through all of the information sessions collected 

O from the local sites 

m Searching - The user can search for particular sets of data based on specific 
s 1 5 information, such as a site or a date 

■ Ranking and sorting - The user can sort the data and assign rankings based on 
categories such as threat type, risk score, remediation cost, target types, and 
vulnerabilities. 

^2 ■ Comparison - The user can compare report sessions between the Professional 

0 Assessor and Planner, across different dates, and through other means. 

Because of the web-enabled capability of the TIMS 130, a client-server arrangement is used 

as depicted in Figure 48. The TIMS 130 server handles the reception and storage of the local VAT 

200 sessions, capturing each separate VAT Database 220 into one comprehensive data store. The 

user then accesses the collection of VAT 200 data by pointing their Web browser to the TIMS 130 

2 5 server. The server also handles login and password authentication before allowing VAT 200 data to 

be viewed. 

VAT Editor 

The AVAT 100 Suite includes an editor that is capable of modifying the VAT 200 user 
interface, database, and reports formats. The editor is a standalone application that interfaces with 



the VAT Database 220 in order to make all of the available modifications. This is possible because 
the user interface definitions and report formats for the VAT 200 are all stored in the database 
instead of being compiled into the VAT 200 executable. 

The VAT Editor 150 is capable of creating and editing the user interface screens and can 
define screens that are tailored to different types of users. It can edit the database to add object 
instances into the data model and modify the influence network 500. Finally, the VAT Editor 150 
can create, edit, and delete report formats to create new and customized reports to meet future needs. 
User Interface Desig n 

The VAT Editor 150 will allow the user to both view and change many aspects of the VAT 
200 application. It is designed to allow a knowledgeable user to customize and extend the VAT 200 
to address fliture user needs. The tool will have a mode for viewing and modifying the VAT 200 
user interface, database, and output report formats. Each mode displays an overall picture of the 
item being edited and provides a toolbar on the left to issue edit commands. A mockup of the 
interface is shown in Figure 11. 

The User Interface Editing mode presents the user with a representation of the current screen 
flow in the system. It then allows the user to modify the flow of the screens, the content of the 
screens, and the look and feel of the application. Because the flow and contents of the screens are 
highly dependent on the contents and structure of the database, the Database 220 mode is always 
available to the user for reference. 

The Database Editing mode provides the user with the abiUty to view and move around the 
database and its contents. It is capable of showing both the data model and the influence network 
500. From there the user can select a class or node to view and/or modify. 

The Report Format Editing mode allows the user to view the format of the reports in the 
VAT 200. They can then create new reports from scratch, create new reports fi-om existing report 
formats, and edit existing report formats. The VAT Editor 150 will display the sections, paragraphs. 



and clauses that comprise the report format. The user can then select items to edit and'or insert new 
items from a list The screen listing the three editing modes is shown in Figure 49. 
User Interface Editing 

There are two aspects of the User Interface that can be modified: the dynamic content and 
5 the overall look and feel as shown in Figure 50. 

Nodes in the influence network 500 and the objects in the data model 2600 drive the 
dynamic content of the user interface, shown above. Each of these items has one or more GUI 202 
definitions associated with it as shown in Figure 51. 

Each GUI 202 definition is also associated with a specific user type that will use it. The user 

9 0 is able to: 

■ Create and edit user types 
yl m Create and edit the GUI 202 definitions that the GUI Engine 210 associates with 

m each user type for each node and data model object. 

m The GUI 202 definitions completely describe the dynamic content for the given object. 

H 5 Using the VAT Editor 150 the user is able to specify. 

H ■ The title for the screen 

5; ■ Screen breaks 

;^ ■ Static text 

^ ■ Data input and output fields including: 

2 0 ■ Associated prompts and questions 

■ Where the data is stored in the database 

■ How it should be entered including: 

■ Size limits 

■ Type limitations 
2 5 ■ Choice lists 

■ Default values 



■ Placement 

■ Source file 

Buttons including: 

■ Text label 

■ Type 

■ Action 

■ The objects in the database that should be filled in next 
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In addition to defining the dynamic content of the user interface the VAT Editor 150 can 
also specify the look and feel of the appUcation. This applies to both the dynamic content and the 
static content. For the dynamic content the user can specify: 

■ What type ofGUI 202 component is used for each type of data. Example: Boolean 
5 values are displayed using check boxes or a Hst box with true and false choices. 

■ The format for specific types of objects on the screen. Example: Titles are bolded 
and centered. 

For the static content the user can specify: 

■ The colors to use for GUI 202 elements 
10 ■ The fonts to use for GUI 202 elements 

■ The images to use for icons 

O. 

Database Editing 

Zl The database-editing mode will allow the user to update and modify the database 220 to: 

p ■ Create and edit objects in the Data Model 2600 by defining instances of existing 

■M 5 classes. Example: Create a Jeep from the vehicle class by filling in its parameters. 

If ■ Add simple nodes to the Node Tree that can only receive input from the user 

interface, they cannot access data model objects or system calculations. 
J=f ■ Adjust the influence of certain nodes in the Node Tree including any that they create. 

■ Add general data to the database for use in the GUI 202 and reports. 

"2 0 The VAT Editor 150 is not able to edit or add classes in the Data Model 2600 in preferred 

embodiments. 

Output Report Format Editing 

When editing output reports using the VAT Editor 150 the user is able to create, modify, and 
delete report formats in the system. This allows them to customize exiting report formats or create 
2 5 completely news ones as they see fit. Report formats in the VAT 200 consist of sections, which can 
consist of paragraphs that can consist of clauses. The user is able to add, remove, or modify any part 
of a report. 
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To create even more customized reports, the VAT Editor 150 allows the user to create, 
modify, and delete the available sections, paragraphs, and clauses in the system. The user can edit 
both the content and the formatting of the items in the report. The paragraphs and clauses are where 
all the report content is created. Sections, which can contain only paragraphs, are used to 
conveniently group paragraphs together for later reuse. 

The paragraphs in an output report can consist of: 

■ Static Text 

■ Results from simple queries of the database that retum graphs or tables 

■ Results from a report plug-in 

■ Groups of clauses in the report system 

■ Images 

Clauses in a report can consist of: 

■ Static text 

■ Data values in the database 

■ Results from simple queries of the database that return, text or simple data values 
Figure 52 illusfrates the various components of the Editor 150. The VAT Editor 150 reuses 

packages of the VAT 200. Figure 53 illusfrates the various subsystems of the VAT Editor 150. 

The invention has been described above in connection with a preferred embodiment related 
terrorist risk management. However, the architecture of the invention lends itself to modification for 
various other types of risk, including but not limited to the following: 

Infrastructure Attacks 

Information Theft (hackers, computer theft, etc.) 
Financial Risk Management 
Insurance Risk Management 
Environmental Hazards 

Risks to On-Orbit Satellite Systems and Constellations 
Risks Associated with Air and/or Highway Travel 
Risks to Manned and Unmanned Space Travel 



MiKtary Planning and targeting (inverse of the risk problem) 
Executive/Personal Protection 
Home Security 
Building Security 

Program and Project Risk Management 
Drug Research or Other R&D Planning 

The modification is aided by the plug-in architecture of the invention. As discussed above, 
risk = probability * vulnerability. Vulnerability is based on both susceptability and consequence. 
The structure of the influence network lends itself to modification for any of the above-referenced 
risk situations. For example, in terrorism risk management embodiments, the invention calculates 
susceptibility based in part upon the 3D simulation/gaming environment (referred to above as 
accessability calculations) and in part upon consequence calculations performed by existing extemal 
programs via the plug-in interfaces. Modification of this embodiment for an application such as 
home security is straightforward. For example, the consequence calculations, instead of being 
performed with blast and CBR models, can be simphfied to calculate property loss and damage as a 
result of a burglary. The 3D simulation/ gaming environment can be modified to calculate vectors 
representing probable burglar entry routes rather than weapons delivery routes. As anotiier example, 
the invention may be modified for risk management of information theft by replacing the 3D 
simulation/gaming environment with a network security model. As a still firrther example, in a risk 
management system directed toward risks associated with space travel, the 3D simulation/gaming 
environment (which calculates accessibility) can be replaced with a model that calculates the 
proxinuty of the spacecraft to space debris, and the blast/CBR calculators can be replaced with 
similar programs that model damage to the spacecraft resulting fi-om collisions with space debris. 



While the invention has been described in detail in connection with the preferred 
embodiments known at the time, it should be readily understood that the invention is not Umited to 
such disclosed embodiments. Rather, the invention can be modified to incorporate any number of 
variations, alterations, substitutions or equivalent arrangements not heretofore described, but which 
are commensurate with the spirit and scope of the invention. 

Accordingly, the invention is not to be seen as limited by the foregoing description, but is 
only hmited by the scope of the appended claims. 



WHAT IS CLAIMED IS: 

1 . An apparatus for assessing a risk of a terrorist attack comprising: 
a memory; 

an input device; 

a display device; and 

a processor connected to the memory, the input device and the display jdevice, the processor 
being configured to perform the steps of: 

inputting information about a site of potential terrorist attack from a user; 

constracting a model of the site based on the information input from the user; 

accepting a designation from the user of a weapon and dehvery point at the site; 

detenmning an accessability of the site to the weapon/delivery point by determining 
a threat vector which is mostly likely the threat vector by which the we^on will be delivered and the 
likelihood of a successfiil deUvery based on the model; 

determining a probability that a terrorist attack will occur; and 

calculating a relative risk based at least partially on the accessibility and probabiUty. 

2. The apparatus of Claim 1, wherein the relative risk is further based on a 
consequence calculation. 

3. The apparatus of Claim 2, wherein the consequence calculations is performed by 
outputting data including model data to a consequence calculator plug-in and accepting consequence 
data from the plug-in. 

4. The apparatus of Claim 1, wherein the processor is fiirther configured to perform the 
step of preparing a report including the probability, accessability and relative risk. 

5. The apparatus of Claim 1, wherein the processor is fiirther configured to perform the 
step of displaying a three dimensional representation of the most likely threat vector to the user. 



6. The apparatus of Claim 1, wherein the relative risk is calculated using a Bayesian 
network. 

7. A method for assessing a risk of a terrorist attack comprising the steps of: 
inputting information about a site of a potential terrorist attack from a user; 
constructing a model of the site based on the input from the user; 

accepting a designation from the user of a weapon and delivery point at the site; 

determining an accessability of the site to the weapon/delivery point by determining a threat 
vector which is mostly likely the threat vector by which the weapon will be dehvered and the 
likelihood of a successftil delivery based on the model; 

deterrnining a probability that a terrorist attack will occur; and 

calculating a relative risk based at least partially on the accessibility and probability. 

8. The method of Claim 7, wherein the relative risk is fiirther based on a consequence 
calculation. 

9. The method of Claim 8, wherein the consequence calculations is performed by 
outputting data including model data to a consequence calculator plug-in and accepting consequence 
data from the plug-in. 

1 0. The method of Claim 7, wherein the processor is ftirther configured to perform the 
step of preparing a report including the probabihty, accessability and relative risk. 

1 1 . The method of Claim 7, wherein the processor is frirther configured to perform the 
step of displaying a three dimensional representation of the most likely threat vector to the user, 

12. The method of Claim 7, wherein the relative risk is calculated using a Bayesian 
network. 

13. A method of assessing risk comprising the steps of 
calculating a probability that an event will occur; 
calculating a vulnerabihty to the event; and 
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calculating a relative risk based on the probability and vulnerability; 
wherein the calculating steps are performed using an artificial intelligence network. 
14. The method of Claim 13, wherein the artificial inteUigence network is a Bayesian 
network. 

5 15. The method of Claim 13, wherein the vulnerability is based upon a susceptabiUty to 

the event and a consequence of the event. 

16. The method of Claim 15, wherein the susceptability is based upon an accessabiUty 
which is determined fi:om a model of a physical environment. 

1 7. The method of Claim 13, wherein the risk is a risk of a terrorist attack. 

£|0 18. The method of Claim 13, wherein the risk is a risk of an infi-astructure attack. 

19. The method of Claim 1 3 , wherein the risk is a risk of an information theft. 
ifl 20. The method of Claim 13, wherein the risk is financial loss. 

21. The method of Claim 13, wherein the risk is insurance loss. 
H= 22. The method of Claim 1 3, wherein the risk is environmental hazard. 

H 5 23 . The method of Claim 13, wherein the risk is risk of loss or damage to on-orbit 

'^t satellite systems and constellations. 

24. The method of Claim 1 3, wherein the risk is associated with ak travel. 

25. The method of Claim 1 3, wherein the risk is associated with highway travel. 

26. The method of Claim 1 3, wherein the risk is associated with manned and unmanned 
2 0 space travel. 

27. The method of Claim 13, wherein the risk is associated with military action. 

28. The method of Claim 13, wherein the risk is injury to a person. 

29. The method of Claim 1 3, wherein the risk is crime committed on a person. 

30. The method of Claim 1 3, wherein the risk is a risk to home security. 

2 5 31. The method of Claim 1 3, wherein the risk is a risk to building security. 
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32. The method of Claim 1 3 , wherein the risk is program and project risk management. 

33. An apparatus for assessing risk comprising: 

a database for storing information including information about at least one actor, physical 
surroundings, and expert observations; 
5 a simulation and gaming environment in communication with the database for determining a 

threat vector and a likelihood that the threat will succeed; 

a plug-in interface in communication with the database and connectable to a consequence 
calculator for outputting information from the database to the consequence calculator and inputting 
information concerining a consequence of an undesirable event; and 
■^0 a decision support system in communication wiih the database for calculating a relative risk 

based on probabiUty and vulnerability determined from information in the database and information 
m from the simulation and gaming environment and the plug-in interface. 

S 34. The apparatus of claim 33, fiirther comprising a report generator for assembling a 

report concerning the relative risk. 
Ei. 5 35. The apparatus of claim 34, ftirther comprising a theater information management 

'Jj system for sharing database information with remote terminals or computers. 

36. The apparatus of claim 33, wherein the database is an object oriented database. 

37. The apparatus of claim 36, wherein objects in the database are persistent objects. 

38. The apparatus of claim 33, wherein tiie information in the database ftirther includes 
2 0 historical information. 

39. The apparatus of claim 33, fiirther comprising an editor for editing information in 
the database. 

40. The apparatus of claim 33, whereim the risk is a risk of terrorist attack. 

41. The apparatus of claim 33, wherein the decision support system employs a Bayesian 
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ABSTRACT 

An integrated risk management tool includes a persistent object database to store 
information about actors (individuals and/or groups), physical surroundings, historical events and 
other information. The risk management tool also includes a decision support system that uses data 

5 objects from the database and advanced decision theory techniques, such as Bayesian Networks, to 
infer the relative risk of an undesirable event. As part of the relative risk calculation, the tool uses a 
simulation and gaming environment in which artificially intelligent actors interact with the 
environment to determine susceptibility to the undesired event. Preferred embodiments of the tool 
also include an open "plug-in" architecture that allows the tool to interface with existing 

0 consequence calculators. The tool also provides facilities for presenting data in a user-friendly 
manner as well as report generation facilities. 



-76- 



DC:40479.1 



FIGURE 1 



I/O 




w 



FIGURE 2 




FIGURE 3 




3oo 



FTGURE 4 




Reports ^''^ Layout 




VATGUItajmafc^ 



FIGURE 5 




FIGURE 6 




FIGURE 7 




FIGURE 8 




FIGURE 9 



VAT Plug- 
in Interface 



2.(3 0 



Analytic 
Model 
Plug-in 



Model Plug-in 
Interface 



External 
Analytic 
Model 



FIGURE TO 



User Input 




Custom 
Report 



FIGURE 11 




FIGURE 12 




FTGTTRE 13 




FIGURE 14 



FIGURE 15 




FIGURE 16 




FIGURE 17 




FIGURE 18 



FTGTJRE 19 



; - Cbjeot . , 



FIGURE 20 




VIEW 3 



VIEW 4 

4) 



FTGURE 21 



Influence Network 



^ecognizability 



Avoid Obstacle* jerrain Effects Effectiven 

mpassible on Soeed and Counlerm. 

Areas on Speed and ^ i^^, Threat Paths 



FIGURE 22 



Susceptibility 




Relative Risk 



Countermeasure 
Effectiveness vs. 
Threat 



FIGURE 23 



Blast and Fragment Plug-in 




FIGURE 24 



Chemical/Biological/ 
Radiological Plug-in 




Piug-in 






Analytic 
Model 








Analytic 
Model 














Analytic 
Model 



FIGURE 25 



-Paragraph 



Clause 



lause 




Ciause 



' Paragraph 



Clause 



lause 



Clause 



FTGTJRE 26 





SITE PROFILER 



FIGURE 27 



2 7^0 

6 



REGION_DIVlSIC>N 



- | SITE BASELINE ' ^ 1 S Q- 

THREAT ^ 2 1 3_3 

— I SITELA,YOUT ^ ^ 3 / 



FIGURE 28 



User 




FIGURE 29 



1 \ 




Dynamics Module 



A / 



* IVafPlugin 
^ IVatAnalyticModel 
* IVatDataAnalyisModule 
* iVatlOModule 



IVatAnalytic Model 



FIGURE 30 




FTGURE 31 



3 /c-oa 




Ci 

y 



FIGURE 32 





FTGIJRE 33 




Consequences 



Vulnerability 
Assessment 



FIGURE 34 




FIGURE 35 




FIGURE 36 




FIGURE 37 




FIGURE 38 




FIGURE 39 



FIGURE 40 




FIGURE 41 




FIGURE 42 




FIGURE 43 



^70 




FIGURE 44 





FTGURE 45 



The VAT has internal 
classes which implement 
each of the exposed 
external interfaces 



Plug-in < 




Container 


1 iVAT Plug-in Interface 



Analytic 
Model 




IVAT Analytic Model 








These are the 
interfaces that are 
exposed to VAT 
plug-in nriodules 



lO Module 



IVAT lO Module 



FIGURE 46 




FIGURE 47 



■ -Wixi 



Region of Interest 

_J jsoutheas 3 



Back Foward 



FIGURE 49 



FiJe Edit ..Go .Help 

static Look & Feel 

User-Type 

Edit User Types 



|— Static Look & Fi 



Color Scheme 



—Dynamic Look & Feel 

Text Styles j 

, input/Ouput Elements | . 

Dynamic Look & Feel 

Add Definition j 

Remove Definition i 



Link Object To Definition i 
Set Branching Condition { 



Report Formats 



TITLE 
INPUT 
INPUT 
INPUT 
INPUT 



Screen Definition 



User In 
Please enter your name: 
Please enter your military ID. 



UserMilID 
UserRank 



Screen Preview 



FIGURE 50 




FIGURE 51 




FIGURE 52 




FTGIIRE 53 




Page 1 



Docket No.: 8594-001-64 

WE (I) the undersigned inventor(s), hereby declare(s) that: 

My residence, post office address and citizenship are as stated below next to my name, 

We (I) beheve that we are (1 am) the original, first, and joint (sole) inventor(s) of the subject matter 
which is claimed and for which a patent is sought on the invention entitled 

METHOD AND APPARATUS FOR RISK MANAGEMENT 

the specification of which 

■ is attached hereto. 

□ was filed on 

as Application Serial No. 
and amended on 

□ was filed as PCT international application 
Number 

on 

and was amended imder PCT Article 19 

on (if applicable). 

We (I) hereby state that we (1) have reviewed and understand the contents of the above-identified 
specification, including the claims, as amended by any amendment referred to above. 

We (I) acknowledge the duty to disclose information known to be material to the patentabihty of 
this application as defined in Section 1.56 of Title 37 Code of Federal Regulations. 

We (I) hereby claim foreign priority benefits under 35 U.S.C. §1 19(a)-(d) or §365(b) of any foreign 
application(s) for patent or inventor's certificate, or §3 65(a) of any PCT International application which 
designated at least one country other than the United States, listed below and have also identified below, 
by checking the box, any foreign application for patent or inventor's certificate, or PCT International 
application having a filing date before that of the appUcation on which priority is claimed. Prior Foreign 
Application(s) 

Application No. Country Day/Month/Year Priority Claimed 



□ 


Yes 


□ 


No 


□ 


Yes 


□ 


No 


□ 


Yes 


□ 


No 


□ 


Yes 


□ 


No 



Page 2 



We (I) hereby claim the benefit under Title 35, United States Code, § 1 1 9(e) of any United States 
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